CVE-2026-64740

9.3 criticalEPSS 0.2%

Critical (9.3) in apple. EPSS 0.2% chance of exploitation in the next 30 days.

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. A malicious app may be able to break out of its sandbox.

Severity

CVSS 3.1

9.3 critical

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-07-27
Modified: 2026-08-17
Record from: the NVD, synced 2026-10-19

Affected

apple:ipados
apple:iphone_os
apple:macos
apple:tvos

References

https://support.apple.com/en-us/128066
https://support.apple.com/en-us/128067
https://support.apple.com/en-us/128069
https://support.apple.com/en-us/128071
https://support.apple.com/en-us/128072

Check your stack JSON