Executive brief
A vulnerability in Apple iOS and iPadOS allows a malicious app to leak sensitive kernel state information that should remain protected from user-space applications. An attacker exploiting this could gain unauthorized visibility into low-level system internals, potentially revealing details that could be chained with other vulnerabilities to compromise device security or extract sensitive data.
Technical details
This vulnerability is an information disclosure flaw that allows an app running on the device to leak sensitive kernel state. The root cause involves insufficient validation in the kernel interface exposed to user-space processes. The attack vector is local and requires no special privileges beyond running an app on the device. An attacker can craft a malicious application that, through improper validation checks, accesses and leaks kernel memory or state information that would normally be restricted. The fix was addressed with additional validation to prevent unauthorized kernel state access. No user interaction is required beyond installing and running the malicious app.
Affected products
- Apple iOS before 18.7.10 and 27
- Apple iPadOS before 18.7.10 and 27
- Apple macOS before Golden Gate 27
- Apple tvOS before 27
- Apple visionOS before 27
- Apple watchOS before 27
Timeline
- 2026-08-17: disclosed: CVE-2026-64760 disclosed
- 2026-08-17: patched: iOS 18.7.10 and iPadOS 18.7.10 released