CVE-2026-64745

Analyzed Analyzed - Analysis Complete

Lock Screen Bypass in macOS Allows Contact and Photo Access

Publication date: 2026-07-27

Last updated on: 2026-07-28

Assigner: Apple Inc.

Description

This issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A person with physical access to a locked device may be able to access contacts and photos.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-28

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-64745

EUVD

EUVD-2026-49496

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	From 15.0 (inc) to 15.7.8 (exc)
apple	macos	From 26.0 (inc) to 26.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability allows a person with physical access to a locked device to bypass restrictions and access contacts and photos. It was addressed by adding additional restrictions on the lock screen in specific macOS versions.

Detection Guidance

This vulnerability involves physical access to a locked device allowing access to contacts and photos. Detection requires checking if your macOS version is affected and monitoring for unauthorized physical access. Verify your macOS version with 'sw_vers' and ensure it is at least Sequoia 15.7.8 or Tahoe 26.6. If not, update immediately.

Impact Analysis

If someone gains physical access to your locked device, they may be able to view your contacts and photos without unlocking the device. This could lead to privacy breaches or unauthorized access to sensitive information.

Compliance Impact

The vulnerability allows physical access to a locked device, potentially exposing contacts and photos. This could lead to unauthorized data access, which may violate GDPR's data protection principles or HIPAA's safeguards for protected health information if such data is involved.

Mitigation Strategies

Update to macOS Sequoia 15.7.8 or macOS Tahoe 26.6 or later to address the issue.

Hi! I’m here to help you understand CVE-2026-64745. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70