AppleCVE-2026-64732

Apple iOS and iPadOS: improper access control

CVE-2026-64732 · Published Jul 27, 2026 · updated Aug 25, 2026

Medium4.6

Fix: upgrade to 18.7.10 or later (3 fixed versions below)

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7. An attacker with physical access may be able to access sensitive user data during iPhone Mirroring.

Affected versions

Package	Affected	Fixed in
iOS and iPadOS Product	< 18.7.10	18.7.10
	< 26.6	26.6
macOS Product	< 15.7.7	15.7.7

Details and references

CVSS 3.1: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-284

More Apple advisories

All Apple

Critical 9.8Jul 27

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-64769fixed in 18.7.10 +3 Critical 9.8Jul 27

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-64770fixed in 18.7.10 +3 Critical 9.8Jul 27

Apple iOS and iPadOS: buffer overflowCVE-2026-64771fixed in 18.7.10 +2 Critical 9.8Jul 27

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-64772fixed in 18.7.10 +2 Critical 9.8Jul 27

Apple iOS and iPadOS: integer overflowCVE-2026-64774fixed in 18.7.10 +3 Critical 9.8Jul 27

A memory initialization issue was addressed with improved memory handlingCVE-2026-64775fixed in 26.6 +2