CVE-2026-64752

Executive Summary

CVE-2026-64752 is a memory corruption vulnerability (CWE-787: Out-of-bounds Write) in Apple's iPadOS and related operating systems (iOS, macOS, visionOS) that can be triggered by processing a maliciously crafted image file, leading to arbitrary code execution. The flaw was addressed by removing the vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27. With a CVSS base score of 7.3 (High), the vulnerability requires local access and user interaction but can result in full compromise of confidentiality, integrity, and availability on affected devices.

Technical Analysis

The vulnerability is classified as an out-of-bounds write (CWE-787) within an image processing component. The NVD description explicitly states that the issue is a "memory corruption issue" and that it was "addressed by removing the vulnerable code." This indicates that the flaw lies in a code path responsible for parsing, decoding, or rendering image data. The attack surface is any application or system service that processes images, including the Photos app, Messages (image previews), Safari (rendering web images), Mail (inline image display), and potentially the Quick Look framework or third-party apps using system image APIs.

The exact function, class, or file path is not disclosed in the NVD description. No CVE description mentions specific library names (e.g., ImageIO, CoreGraphics), so we must avoid inventing them. The root cause is a boundary condition where a crafted image triggers a write beyond the allocated buffer. This is a classic memory corruption primitive that can lead to controlled or uncontrolled code execution depending on the heap layout and the attacker's ability to shape memory. Since the vulnerable code was removed rather than patched with bounds checks, it suggests the code path was either deprecated or its logic was fundamentally flawed, necessitating removal.

The CVSS vector indicates: AV:L (local access, but the attack vector involves a file processed locally), AC:L (low attack complexity), PR:L (low privileges required—the user context of the processing app), UI:R (requires a user to open or view the malicious image), S:U (no scope change), and C/I/H all High. The "Local" vector may reflect that the exploit is not remotely triggerable over the network directly; instead, the attacker must deliver the image file to the target (e.g., via email, messaging, or web download) and cause the user to process it.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for this CVE. The following scenario is inferred from the vulnerability class (out-of-bounds write in image processing) and the CVSS vector.

1. Reconnaissance/Target Identification: An attacker identifies targets running affected Apple operating systems (pre-iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27). These devices are used by individuals and enterprises; the attacker may target specific users via email or messaging, or broadly via watering-hole attacks on websites that serve images.

2. Triggering the Flaw: The attacker crafts a malicious image file (e.g., a PNG, JPEG, HEIC, or another format supported by the system) that, when parsed, causes an out-of-bounds write due to insufficient bounds checking on a buffer. The exact image format and the specific malformed field are not detailed in the NVD description. The attacker then delivers this image to the victim through a channel that automatically or semi-automatically processes it: for example, attaching it to an email, sending it via iMessage, hosting it on a website that the victim visits, or embedding it in a document.

3. Payload/Execution: Upon processing the image (e.g., the user opens the image, views a message preview, or loads a webpage), the memory corruption triggers. Depending on the heap layout, the out-of-bounds write may overwrite adjacent memory structures, such as function pointers or object metadata. This can lead to arbitrary code execution in the context of the application that processed the image (e.g., Messages, Safari, Photos). The attacker may need to employ heap grooming techniques to achieve reliable control, but the CVSS AC:L suggests the complexity is low—possibly the corruption directly leads to a controlled write or the overwritten data is predictable.

4. Post-Exploitation Impact: Successful exploitation grants the attacker code execution with the privileges of the processing application. On iOS/iPadOS, apps are sandboxed, so the attacker may need to chain additional vulnerabilities to escape the sandbox and gain persistence or access sensitive data. However, even within the sandbox, the attacker could steal files accessible to that app, exfiltrate data, or perform actions on behalf of the user. On macOS, the impact could be more severe if the vulnerable component runs with higher privileges (e.g., a system service). Given the CVSS scope is Unchanged, the exploitation does not automatically cross security boundaries, but it still compromises the confidentiality, integrity, and availability of the affected component and its data.

Impact Assessment

The business impact of CVE-2026-64752 is significant for organizations that rely on Apple devices. A successful exploit can lead to arbitrary code execution, enabling attackers to steal sensitive data (emails, documents, photos, credentials), install malware, or pivot to other systems. The CVSS score of 7.3 (High) reflects the severity: local attack vector (AV:L) means the attacker must deliver a file to the victim, but the low complexity (AC:L) and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) make it a serious threat. The requirement for user interaction (UI:R) somewhat mitigates mass exploitation, but social engineering is often effective.

Affected systems include all devices running iOS, iPadOS, macOS, and visionOS versions prior to the fixes. Given Apple's large install base, the blast radius is potentially millions of devices. Enterprise environments with BYOD policies or fleets of Apple devices are at risk. The EPSS score is very low (0.00138, 3.5th percentile), indicating that as of the data provided, exploitation is not widely observed. CISA KEV does not list this CVE, suggesting no known active exploitation in the wild at this time. However, the lack of public PoC does not preclude private exploitation by advanced threat actors.

Detection Guidance

Sigma Rule

title: Suspicious Image File Processing Triggering Memory Corruption
id: 8a9b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects attempts to exploit CVE-2026-64752 via malicious image files, indicated by abnormal crashes or memory corruption in image processing daemons.
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: macos
detection:
  selection_image:
    Image|endswith:
      - '/Messages'
      - '/Safari'
      - '/Photos'
      - '/QuickLookUIService'
      - '/com.apple.WebKit.WebContent'
  selection_crash:
    CommandLine|contains:
      - 'EXC_BAD_ACCESS'
      - 'SIGSEGV'
      - 'heap corruption'
  condition: selection_image and selection_crash
falsepositives:
  - Legitimate application crashes unrelated to exploitation.
level: high

YARA Rule

rule CVE_2026_64752_MemoryCorruption_Image
{
    meta:
        description = "Detects malicious image files that may trigger CVE-2026-64752 memory corruption"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64752"
        hash = "unknown"
    strings:
        $img_magic_png = { 89 50 4E 47 0D 0A 1A 0A }
        $img_magic_jpg = { FF D8 FF }
        $img_magic_heic = { 00 00 00 18 66 74 79 70 68 65 69 63 }
    condition:
        (uint16(0) == 0x4D42 or $img_magic_png at 0 or $img_magic_jpg at 0 or $img_magic_heic at 0) and
        filesize < 10MB and
        ( // heuristic: unusual chunk size or trailing data after image end
          for any i in (0..filesize-4) : (uint32(i) == 0x49454E44) and (i+8 < filesize)
        )
}

Note: This YARA rule is heuristic and may produce false positives. It is intended to flag image files with anomalous structures, but without a known exploit sample, it cannot reliably detect the specific trigger.

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-64752 Possible Apple Image Memory Corruption Exploit Attempt"; flow:to_server,established; content:"|89 50 4E 47 0D 0A 1A 0A|"; depth:8; content:"|49 45 4E 44|"; distance:0; within:4; content:"|00 00 00 00|"; distance:4; within:4; classtype:attempted-user; sid:10000001; rev:1;)

This rule is speculative and based on the vulnerability class. Without a known exploit, it may not detect actual attacks.

Elastic Detection

sequence by host.hostname with maxspan=5s
  [process where process.name in ("Messages", "Safari", "Photos", "QuickLookUIService") and process.parent.name != null]
  [file where file.extension in ("png", "jpg", "jpeg", "heic", "tiff") and event.action == "file_opened"]

This EQL sequence looks for image files being opened by vulnerable Apple processes, which could be a precursor to exploitation. However, it will generate many false positives from normal user activity.

Splunk SPL Query

index=apple_logs (process_name="Messages" OR process_name="Safari" OR process_name="Photos" OR process_name="QuickLookUIService")
| search "crash" OR "EXC_BAD_ACCESS" OR "SIGSEGV" OR "memory corruption"
| stats count by host, process_name, signature, _time
| where count > 1
| sort - _time

This query searches for repeated crashes in image-processing applications, which could indicate exploitation attempts. Adjust index and field names to match your environment.

Wazuh OSSEC Rule

<group name="apple,cve-2026-64752,">
  <rule id="100200" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">Messages|Safari|Photos|QuickLookUIService</field>
    <field name="event.action">crash</field>
    <field name="error.type">EXC_BAD_ACCESS|SIGSEGV|memory corruption</field>
    <description>CVE-2026-64752: Possible exploitation attempt causing memory corruption in Apple image processing</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

This Wazuh rule assumes logs are ingested via JSON with fields like process.name, event.action, and error.type. Adjust field names to match your log source.

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The patch is claimed by a single source (NVD) and has not been independently confirmed.

1. Immediate Mitigations:

   • Update all affected Apple devices to iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27 as soon as possible. Since the patch is claimed, verify the update from official Apple sources.
   • Until patching is complete, avoid opening untrusted images from unknown sources. Disable automatic image previews in messaging and email clients where possible.
   • Apply the principle of least privilege: run applications with minimal necessary permissions.
   • Monitor for crashes in image-processing applications, which could indicate exploitation attempts.

2. Patch/Upgrade Steps:

   • For iOS/iPadOS: Navigate to Settings > General > Software Update and install the latest version.
   • For macOS: Go to System Settings > General > Software Update.
   • For visionOS: Use the Settings app on the device to check for updates.
   • Ensure that all devices in the organization are updated, including BYOD devices if policy allows.

3. Long-Term Hardening:

   • Implement application allowlisting to prevent unauthorized applications from processing images.
   • Use endpoint detection and response (EDR) tools that can detect memory corruption and anomalous process behavior.
   • Educate users about the risks of opening unsolicited images or attachments.
   • Regularly review and apply security updates from Apple. Consider using automated patch management for Apple devices.
   • Isolate critical systems from general user networks to limit the blast radius of a compromise.

References

• NVD – CVE-2026-64752: https://nvd.nist.gov/vuln/detail/CVE-2026-64752
• Apple Security Updates: https://support.apple.com/en-us/HT201222 (general reference; specific advisory not provided)
• CWE-787: Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK T1203: Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• EPSS Score for CVE-2026-64752: https://api.first.org/data/v1/epss?cve=CVE-2026-64752

No known threat actor campaigns or exploit-in-the-wild evidence is available for this CVE at the time of writing. CISA KEV does not list this vulnerability.