CVE-2026-64778

Undergoing Analysis Undergoing Analysis - In Progress

Improper Input Validation in Apple iOS and iPadOS

Publication date: 2026-08-17

Last updated on: 2026-08-18

Assigner: Apple Inc.

Description

The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak sensitive data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-18

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-05

NVD

CVE-2026-64778

EUVD

EUVD-2026-60488

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 18.7.10 (exc)
apple	ipados	From 26.0 (inc) to 26.6.1 (exc)
apple	iphone_os	to 18.7.10 (exc)
apple	iphone_os	From 26.0 (inc) to 26.6.1 (exc)
apple	macos	From 26.0 (inc) to 26.6.2 (exc)
apple	safari	to 26.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in Apple's iOS, iPadOS, and macOS Tahoe systems where visiting a maliciously crafted website could lead to the leakage of sensitive data. The issue was addressed with improved checks in specific versions of these operating systems.

Detection Guidance

This vulnerability involves visiting a maliciously crafted website that may leak sensitive data. Detection primarily involves checking for unauthorized data exfiltration or unusual network activity. Ensure your system is updated to iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, or macOS Tahoe 26.6.2 to mitigate the issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to access and leak sensitive information from your device by tricking you into visiting a malicious website. This could include personal data, login credentials, or other confidential information.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The issue involves sensitive data leakage from maliciously crafted websites, which could potentially impact data protection requirements under such regulations.

Mitigation Strategies

Update affected systems to the latest patched versions: iOS 18.7.10 or later, iPadOS 18.7.10 or later, iOS 26.6.1 or later, iPadOS 26.6.1 or later, and macOS Tahoe 26.6.2 or later. Avoid visiting untrusted websites until updates are applied.

Hi! I’m here to help you understand CVE-2026-64778. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70