Executive brief
HFS is Apple's file system used to store and organize data on Mac computers. A buffer overflow vulnerability in HFS could allow a malicious app to crash the system unexpectedly or write data directly to kernel memory, potentially compromising system integrity and stability. This could lead to unauthorized access, data corruption, or system compromise.
Technical details
The vulnerability is a buffer overflow in the HFS (Hierarchical File System) component, addressed with improved bounds checking. The issue allows an app to cause unexpected system termination or write to kernel memory. Attack vector is local (app-based); no network access or special privileges are required beyond what a standard app might have. An attacker can exploit this by crafting malicious input that overflows a buffer in HFS code. The fix was applied across multiple macOS versions (Sequoia 15.7.7, Sonoma 14.8.7, and Tahoe 26.6) and iOS/iPadOS 26.6.
Affected products
- Apple macOS Sequoia before 15.7.7
- Apple macOS Sonoma before 14.8.7
- Apple macOS Tahoe before 26.6
- Apple iOS before 26.6
- Apple iPadOS before 26.6
Timeline
- 2026-08-25: disclosed: CVE-2026-64705 published
- 2026-05-11: patched: Patches released for macOS Sequoia 15.7.7 and macOS Sonoma 14.8.7