Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to execute arbitrary code with kernel privileges.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-27 | 1 | Disclosure1 |
| 2026-08-03 | 3 | Disclosure2Patch1 |
| 2026-08-14 | 1 | Disclosure1 |
| 2026-08-18 | 1 | Patch1 |
| 2026-10-15 | 1 | General1 |
| 2026-10-26 | 1 | General1 |
Apple credited me today for CVE-2026-64747, a vulnerability in AVEVideoEncoder affecting macOS/iOS. It earned a $60K accelerated bounty after I captured an Apple Target Flag. Write-up coming soon. https://t.co/VaJeFjyy1P
Post summary
User announces receipt of credit and a $60K bounty for discovering CVE‑2026‑64747 in AVEVideoEncoder on macOS/iOS, with a write‑up to follow.
@blackwinghq researcher @0xFBFBFBFB landed 4 CVEs in the latest huge Apple security update. CVE-2026-64747 is beautiful “an app may be able to execute arbitrary code with kernel privileges” (iOS and macOS) 🥹. Write up coming soon. Stay tuned, this is just the beginning — we’ve been busy! 😉
Post summary
The tweet announces the discovery of several new CVEs in Apple’s latest security update, mentioning the type of vulnerability for CVE-2026-64747, but provides no proof-of-concept, exploit code, or mitigation details.
!! Apple dropped a new security update. Top 3 fixes I’d prioritize: CVE-2026-64747 - kernel-level code execution CVE-2026-43723 - possible root privilege escalation CVE-2026-65346 code execution via malicious image processing If you manage Apple devices, patch these first. Kernel/root impact + easy-to-reach attack surface = highest priority. Please update!
Post summary
The message announces Apple’s security update, lists three CVEs with kernel and privilege escalation issues, and urges immediate patching of affected devices.
Our own Franco Belman (@0xFBFBFBFB) landed 4 CVEs in the latest Apple security update! Possibly the most impactful bug of the bunch CVE-2026-64747: “an app may be able to execute arbitrary code with kernel privileges” (iOS and macOS) 🥹. Write up coming soon! https://t.co/gJr0zKXDDQ
Post summary
The tweet announces four CVEs resolved in the latest Apple security update, highlighting CVE-2026-64747 as a kernel-level arbitrary code execution vulnerability affecting iOS and macOS, with a technical write-up expected in the future.
@ichitaso It’s up to you. It doesn’t seem like kernel R/W is happening any time soon. I know CVE-2026-64747 was interesting (and worked on iOS according to the author), but the author never did a write up, and no one is looking into it right now. Lots of cool WebKit bugs though.
Post summary
The tweet casually discusses CVE-2026-64747, noting it was a kernel read/write vulnerability that reportedly worked on iOS, but the author never published a writeup and the community is not actively researching it. No PoC, exploit, patch, or active exploitation is mentioned.
Apple has released iOS 26.6, addressing 87 vulnerabilities ahead of iOS 27, including critical zero-click flaws in ImageIO and WebKit, kernel memory corruption (CVE-2026-64747), a code-signing bypass (CVE-2026-43813), and multiple sandbox escapes (CVE-2026-64740, CVE-2026-28973). Available for iPhone 11 and later.
Post summary
Apple has rolled out iOS 26.6, fixing 87 vulnerabilities—including zero‑click flaws in ImageIO/WebKit and several CVEs such as CVE‑2026‑64747 and CVE‑2026‑43813—across iPhone 11 and newer models.
CVE-2026-64747 ilu
Post summary
The text merely references CVE-2026-64747 with no additional context, PoC, exploitation details, patches, or technical information.
CVE-2026-64747: AppleAVE CalcBufSizeOf integer wrap on ios 26.4.2 → stable kernel panic from App Store app → but the UAF window is structurally blocked A thread on why this is (and isn't) exploitable
Post summary
The post announces CVE-2026-64747, highlighting an integer wrap in AppleAVE that can trigger a kernel panic on iOS 26.4.2, while noting mitigation of the use‑after‑free window and referencing a discussion about its exploitability.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | apple | ipados | - | - | - |
| OS | apple | iphone_os | - | - | - |
| OS | apple | macos | - | - | - |
| OS | apple | tvos | - | - | - |
| OS | apple | visionos | - | - | - |
| OS | apple | watchos | - | - | - |