XGPT found an Apple notifyd stack overflow, it has been fixed today in 26.6 tracked as CVE-2026-64739. This is a classic stack overflow. An unprivileged local user can trigger it in notifyd (root daemon) by registering a file monitor with a path longer than `MAXPATHLEN` (1024 bytes). The vulnerable code path uses an inverted size check and writes the full attacker-controlled path length into a fixed-size stack buffer. Faulting thread frames: ```text 0 __pthread_kill 1 pthread_kill 2 __abort 3 __stack_chk_fail <- stack canary detected corruption 4 [notifyd] 5 imageOffset = 0x414141414141 <- saved return address overwritten with 'A' The crash is caught by stack canary.
Post summary
Apple's notifyd has a stack overflow (CVE-2026-64739) caused by an inverted size check, now fixed in version 26.6; the post offers technical details but no PoC or exploitation evidence.
