CVE-2026-64740
Status: ModifiedCritical (9.3)—
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. A malicious app may be able to break out of its sandbox.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Base score: 9.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.21%
- Percentile among all scored CVEs: 10
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1068Exploitation for Privilege Escalationprivilege escalation95 % - Primary impact
T1005Data from Local Systemcollection85 % - Secondary impact
T1548Abuse Elevation Control Mechanismprivilege escalation80 %
CWE-22 (path traversal) en acceso local sin interacción (AV:L/AC:L/PR:N/UI:N) permite sandbox escape en aplicaciones iOS/macOS, escalando privilegios para leer datos del sistema.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (4)
CWEs
- CWE-22
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-64740",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-64740",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-07-28T16:11:12.093790Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 9.3,
"attackVector": "LOCAL",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 2.5
}
]
},
"affected": [
{
"source": "product-security@apple.com",
"affectedData": [
{
"vendor": "Apple",
"product": "iOS and iPadOS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "18.7.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "26.6",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "macOS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "14.8.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "15.7.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "26.6",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "tvOS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.6",
"versionType": "custom"
}
]
}
]
}
],
"published": "2026-07-27T21:17:12.877",
"references": [
{
"url": "https://support.apple.com/en-us/128066",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/128067",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/128069",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/128071",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/128072",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/148287",
"source": "product-security@apple.com"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. A malicious app may be able to break out of its sandbox."
}
],
"lastModified": "2026-08-17T22:17:19.520",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB0E13A1-17E9-4198-A359-304F8145F34F",
"versionEndExcluding": "26.6"
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "622D61A7-C893-4550-800A-8CEDE14F3033",
"versionEndExcluding": "26.6"
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FFAC61B-E4F2-49AF-9897-96D35FAD611C",
"versionEndExcluding": "14.8.8",
"versionStartIncluding": "14.0"
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B3E01512-81BB-4C92-B0A5-C07F1C1A432E",
"versionEndExcluding": "15.7.8",
"versionStartIncluding": "15.0"
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D3D83F1-07DF-47C2-9F3B-0BC5A1434606",
"versionEndExcluding": "26.6",
"versionStartIncluding": "26.0"
},
{
"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D461E49C-A6FA-4AFD-B557-FB066243A708",
"versionEndExcluding": "26.6"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "product-security@apple.com"
}