CVE-2026-64772: 
macOS vulnerability analysis and mitigation

CVE-2026-64772 is an out-of-bounds write vulnerability in Apple's Model I/O framework that allows a remote attacker to cause unexpected application termination or heap corruption. It was disclosed and patched on July 27, 2026, as part of Apple's coordinated security update across multiple platforms. Affected products include iOS and iPadOS (before 26.6), macOS Sequoia (before 15.7.8), macOS Tahoe (before 26.6), tvOS (before 26.6), and visionOS (before 26.6). The vulnerability was discovered by researchers stratan (@5tratan) and wh0am1i. The CVSS category is estimated as HIGH (Apple Advisory iOS/iPadOS, Apple Advisory macOS Tahoe, Feedly).

The vulnerability is classified as an out-of-bounds write (CWE-787) in Apple's Model I/O framework, which is responsible for importing, exporting, and manipulating 3D model data and associated assets. The root cause is insufficient input validation when processing remotely supplied or maliciously crafted model/image data, allowing writes beyond the bounds of an allocated buffer and resulting in heap corruption. An unauthenticated remote attacker can trigger this flaw by supplying a specially crafted file or data stream processed by the Model I/O framework — no user interaction beyond opening or receiving such content appears to be required. Apple addressed the issue with improved input validation (Apple Advisory iOS/iPadOS, Apple Advisory macOS Tahoe, Apple Advisory tvOS).

Successful exploitation can result in unexpected application termination (denial of service) or heap memory corruption, which in turn may enable arbitrary code execution in the context of the affected application. Because the Model I/O framework processes externally supplied 3D model and image data, the attack surface is accessible to remote, unauthenticated attackers who can deliver malicious content to a vulnerable device. Heap corruption primitives of this nature can potentially be chained with other vulnerabilities to achieve more severe outcomes, including privilege escalation or data exfiltration (Apple Advisory iOS/iPadOS, Feedly).

Apple has released patches addressing CVE-2026-64772 across all affected platforms. Users and administrators should update to the following versions or later: iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. No configuration-based workarounds have been published; upgrading to a patched release is the recommended and only confirmed remediation. Refer to Apple support articles 128066, 128067, 128069, 128070, and 128071 for platform-specific guidance (Apple Advisory iOS/iPadOS, Apple Advisory macOS Tahoe, Apple Advisory tvOS, Apple Advisory visionOS, Apple Advisory macOS Sequoia).

Apple disclosed the vulnerability as part of a broad July 27, 2026 security update covering dozens of CVEs across its product ecosystem. No notable independent researcher commentary, media coverage, or significant social media discussion specific to CVE-2026-64772 has been identified beyond standard vulnerability tracking and aggregation sites (Feedly).