CVE-2026-64767: Buffer Overflow

Published Jul 27, 2026
·
Updated

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sequoia 15.8.2, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

Other sources

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

— NVD

Accelerate Framework. An out-of-bounds write issue was addressed with improved bounds checking.

— Apple

Accelerate. An out-of-bounds read was addressed with improved bounds checking.

— Apple

Accounts Framework. This issue was addressed with improved data protection.

— Apple

Accounts. A logging issue was addressed with improved data redaction.

— Apple

Credit

Seiji Sakurai@@HeapSmasher, an anonymous researcher, Bhaswanth Chigurupati, Dave G., We Muftihaturrahmah, Aswin Kumar Gokula Kannan, Ruslan Dautov, Peter Malone, Thomas Guillem, Narendra Singh@@_3P1C, Kwak Kiyong@@Pwnkai23, Song Nuri, Thanatos Tian (HKPolyU) & wgg with Diffract, Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Johan Wahyudi, tamdao, Jaeyeong Lee, Meta Red Team X - Nik Tsytsarkin, Hcamael, 章鱼哥 (aipyaipy.com)@@aipy, Dohyeon An Technology Inc@@PILAB, Rahul Raj, Josh Maine(Calif), Chanwit Muenprakoddee (ChemIndy), YingMuo@@YingMuo(DEVCORE Research Team), Paul Montgomery@@nullevent, lunar815, Nathaniel Oh@@calysteon, Piotr Jerzy Duszynski, Surej Sekhar, r3pwnx@@r3pwnx, Lily Cohl@@GenericCoding, Lakshay Sharma (MrW0r57), Abodi Dawoud, Marco Schmitt(Calif), Andrey Chernykh(Calif), Franco Belman at Blackwing Intelligence, Murray Mike(Nosebeard Labs), Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), 준우 이, Pasquale Scola, Neon, Niels Hofmans, Mustafa Calap@@ordinal0, dbg.re), zenith, Mateusz Jurczyk(Google Project Zero), Tucker Willenborg, Frederick Kaludis (Coiffeur0x90)(Nosebeard Labs), DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, Zwei Tasse Kaffee, Jihwan Yoon, an anonymous researcher(Calif), 章鱼哥 (aipyaipy.com)@@aipy(Calif), Roman Zabicki(Calif), Anna Groza@@pwnlambda(Calif), Altin Gashi, Përparim Mjeku, f4&Zhiniang Peng with HUST(Calif), Aobo Wang@@M4x_1997(Calif), Xiang Chen(Calif), Jakob Pammer(Calif), 정우 하@@0xfa11babe, Chris Bailey - Short Circuit, Nurihan Kim (HanTul)(TrendAI Zero Day Initiative), Jurre van Bergen - Threatnotify, Mathis Mansière, 章鱼哥 (aipyaipy.com）@@aipy, Redon Gashi (Sentry), Sanny Mitra, Alfredo Pesoli@@__rev(Bynar), Koh M. Nakagawa@@tsunek0h(FFRI Security Inc), Csaba Fitzl@@theevilbit(Iru), Lyutoon, Andrey Chernykh (BypassLabs.ai), Keisuke Hosoda, oxsignal, Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), R4mbb, Asaf Cohen, f00l@@PPPF00L, 3ndy1@@_3ndy1, Anand (anandsreekumar.com), He Wei (ギカク), powerprove(Protectiv IT Security Inc), Michael Benich(Protectiv IT Security Inc), Niels Hofmans(Protectiv IT Security Inc), Christian Niel Angel(Protectiv IT Security Inc), Lyutoon(SecuRing), Seung Je Seong(SecuRing), R4mbb(SecuRing), Wojciech Regula(SecuRing), Aswin Kumar Gokulakannan, Minseok Kim, Thanatos Tian (HKPolyU) & wgg & xmr, Marco Schmitt, Yash Pandya, Parth Raval, Sattyam Yadav(Protectiv IT Security Inc), onetwo(Protectiv IT Security Inc), Robert Tran, Merrick Hare, Eddy Tsalolikhin, Johann Rehberger, Wout van der Ploeg (woutvanderploeg.nl), sh3rlock (김보겸), Andrey Chernykh, Sihyun Roh (Compsec, SNU), Charles Stevenson, Seung Je Seong, Bhuwan Bhetwal(Braze Security Team), Kwak Kiyong@@Pwnkai23(Braze Security Team), Song Nuri(Braze Security Team), Nicolas Seriot(Braze Security Team), Tommy DeVoss@@thedawgyg(Braze Security Team), Navapon Premkasem, Richard Zana, Pedro Pinho, Frederick Kaludis (Coiffeur0x90)(DBAppSecurity's WeBin lab), YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Lakshay Sharma (MrW0r57)/WorstCase Labs.(Iru), Ashish Kavishwar(Iru), Gergely Kalman@@gergely_kalman, Wang Yu, Cem Onat Karagun, John Lussier, greenbynox, OpenAI(STAR Labs SG Pte), Billy Jheng Bing Jhong(STAR Labs SG Pte), Pan Zhenpeng@@Peterpan0927(STAR Labs SG Pte), Marc Newlin(SkySafe), Xinru Chi(Pangu Lab), Nebula Security@@nebusecurity(Aginor), Tim Michaud@@TimGMichaud(Aginor), f0r(MurphySec), Arnold Cartagena(Tolmo), Matt Suiche@@msuiche(Tolmo), Jakob Pammer, Jerry L. Knot, Eliya M., Viacheslav Radiukov, Tristan Madani (Talence Security), Daniel Rodríguez, Abodi Dawoud(Lupus Nova), Ilya Andr (andrd3v)(Positive Technologies), Zhongquan Li@@Guluisacat, Mustafa Ahmed, Musaab Khan@@bxff, Saoud Khalifah, stratan@@5tratan, ret2happy@@ret2happy, 진규정 (Gyujeong Jin(DEVCORE Research Team), @@G1uN4sh(DEVCORE Research Team), Lucas Parnell(DEVCORE Research Team), Nathaniel Oh@@calysteon(DEVCORE Research Team), Meta Red Team X - Nik Tsytsarkin(DEVCORE Research Team), Nik Tsytsarkin, Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan), Jonathan Bar Or@@yo_yo_yo_jbo, Mickey Jin@@patch1t, Varik Matevosyan@@D4RK7ET, Prafull Dhiman, Alto_00000, Siddharth Aeri, Gabriel '0xv1n' Cardona, Mrunal Chawda, Kujtim Kryeziu (Sentry), 도현 김, Ithrael, YEONGJAE SHIN, Hongsik Kim (mnur), Efstratios Kaplanellis@@5tratan(Almamater Technologies), ruitong@@abstract, an anonymous researcher(Nosebeard Labs), Niels Hofmans(Nosebeard Labs), 도현 김(Nosebeard Labs), Junyeong Lee (jylab.github.io)(Nosebeard Labs), Jonghoon Han (Aegis), Ahmad Al Harrizuan Izadin(Iru), Prathamesh Walunj(Iru), f4&Zhiniang Peng with HUST, Geonha Lee@@leegn4a, Substrate, Arni Hardarson (Neonix Security), Yujung Choi@@Dusker, Stefan Esser (Calif), Alfredo Pesoli via Bynario Atlas (bynar.io)@@__rev, Anon Tuttu Venus, Mahmoud Abdelmoniem, koocolb, Stav Nir, Vladimir Tokarev, Arni Hardarson (Neonix Security)(Iru), Pranav Gopalkrishnan, Alan Wang, Ailsa Sun, Hovav Shacham, Riccardo Paccagnella, Chris Fletcher, David Kohlbrenner, Richard Hyunho Im at Route Zero Security@@richeeta(Almamater Technologies), Alex Radocea, cnitlrt@@abstract(Sentry), Roman Belovitskiy(Sentry), Lyutoon(Sentry), Art Pllana(Sentry), Redon Gashi(Sentry), lokerxx, Teodor Sorescu@@teodorsorescu, Phillip Groves, cnitlrt@@abstract, Aditya Kumar, Lucas Lammer, Stuart Wallace, 진규정 (Gyujeong Jin, @@G1uN4sh, Albin Haliti, Sindre Sorhus, Morris Richman@@morrisinlife, Bhuwan Bhetwal(ThreatBook), Feng Xue(ThreatBook), XGPT(ThreatBook), Nathaniel Oh@@calysteon(Talence Security), Narendra Singh@@_3P1C(Talence Security), Tristan Madani@@TristanInSec(Talence Security), D4rthL, Santiago Albertengo, Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Gergely Kalman@@gergely_kalman(Nosebeard Labs), Lyutoon(Nosebeard Labs), Jaeyeong Lee(Nosebeard Labs), Maher Azzouzi, Frederick Kaludis (Coiffeur0x90), Mufeed VH(Winfunc Research), 云开 江, Joshua Maina, Mahmoud Gamal@@Zombiehelp54, Thanatos Tian (HKPolyU) & wgg & 2st with Diffract(Aginor), Peter Malone(Aginor), David Krehwinkel, Rotce(SkySafe), Sandeep Wawdane (thecybersandeep)(SkySafe), Ankur Saini(Volexity), Song nuri, Ricardo Prado, Bartlomiej Dmitruk(striga), Stanislaw Strzalkowski(isec), Pinak Oza, Robert Mindo, 章鱼哥.com@@aipyaipy, N.M.Praveen Nawarathne@@zblockrat, Vladislav Shevchenko (Positive Technologies), Dun, Rishabh Jain (rjcyber)(cyberplanet), Irvin Wang, Nicolas Rabrenovic, impost0r (ret2plt), David Ige - Beryllium Security, lokerxx(Economics), Narendra Singh@@_3P1C(Economics), Lyutoon(Economics), Jordy Zomer@@pwningsystems(Economics), Richard Zana(Economics), Aswin Kumar Gokulakannan(Economics), George Stergiopoulos(Economics), InfoSec lab(Economics), Athens University(Economics), Business, Greece, 이재영, Pavan Nallamothu, Jared Reyes, Seonung Park, ALTV!ST (altvi.st/), David Strnadel, Anton Pakhunov, Daniel Febrero, Daniel Williams, Anonymous(TrendAI Zero Day Initiative), ret2happy, Rajdip Dey Sarkar, James Duffy@@0x4A616D657344, Kraken Cryptocurrency Exchange(Nosebeard Labs), Matthew Schneider, Dallas Dubs(Nosebeard Labs), Aaron Grattafiori - NVIDIA AI Red Team(Nosebeard Labs), XBreach.ai(Nosebeard Labs), Yongyue WANG AKA Brian.W(OKX security), Roman Zabicki(Nosebeard Labs), Katika Mohaseen(Nosebeard Labs), CVE-2026-3784, CVE-2026-3783, HvxyZLF, Lance Cain - Offensive Security Engineer, SpecterOps Inc., Mahmoud Abdelmoniem(DBAppSecurity's WeBin lab), Kujtim Kryeziu(DBAppSecurity's WeBin lab), 이재영(Nosebeard Labs), Ilya Andr (andrd3v)(Nosebeard Labs), beist, Hyunwoo Kim@@v4bel, Gil Portnoy & Henry, Anthony Laou Hine Tsuei@@anarcheuz, Ayaan Ahmad, erdene-och Byambabayar, Manuel Fernandez (Stackhopper Security), Stanislav Jelezoglo, Somair Ansar(Calif), Johnny Franks@@0xjohnny, hxr1, Alexandre Soleiman, Alexander Tarasikov, Redon Gashi, Trung Nguyen@@everping(CyStack), Atul R V & Ashmit Sharma, 章鱼哥 （aipyaipy.com）@@aipy, Surya Narayan Kushwaha, Surya Kushwaha, Michael DePlante@@izobashi(TrendAI Zero Day Initiative), Arni Hardarson, Jonathan Alush-Aben, PETOWORKS의 Bugeun Choi@@Bugeun, Igor Ushakov, Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), Ryan Hileman via Xint Code (xint.io), Ashish Kunwar(MurphySec), DARKNAVY@@DarkNavyOrg, Fábio Luís@@scanpt, Adam Doupé(ASU SEFCOM), Pasquale Scola(STAR Labs SG Pte), Gor Aleksanyan, impost0r (ret2plt)(Appknox), Ruslan Dautov(Appknox), Aleksandr Tarasikov(Appknox), jay(Appknox), Dhiyanesh Selvaraj@@redroot97(Appknox), Vinay Kumar Rasala (Xplo8E)(Appknox), Lyutoon(STAR Labs SG Pte), DongJun Kim (smlijun) with UIUC(STAR Labs SG Pte), Hwiwon Lee (hwiwonl) with UIUC(STAR Labs SG Pte), Jongseong Kim (nevul37) with UIUC(STAR Labs SG Pte), Younggi Park (grill66) with UIUC(STAR Labs SG Pte), Peter Malone(STAR Labs SG Pte), an anonymous researcher(STAR Labs SG Pte), Hari Shanmugam (The Hxr1)(STAR Labs SG Pte), Marco Grassi, Daniele Castronovo, Michal Kosiorek, Ruslan Dautov(Baidu Security), 재영 정(Baidu Security), (Rao Ali Nawaz)@@rootxran(Baidu Security), Chanwit Muenprakoddee (ChemIndy)(Baidu Security), an anonymous researcher(Baidu Security), Ye Zhang@@VAR10CK(Baidu Security), Franco Belman at Blackwing Intelligence(Calif), Christian Figueroa(Calif), Johnny Franks@@0xjohnny(Calif), Ashmit Sharma & Atul RV(Calif), Peter Malone(Calif), Muhamad Syaiful(Calif), Muneeb Amin Bhat(Calif), Dhiyanesh Selvaraj@@redroot97(Calif), Ali Marzouq(Calif), Bountyy Oy - Mihalis Haatainen(Calif), Huy Nguyen@@34306(Calif), beist(ASU SEFCOM), Dun(STAR Labs SG Pte), Asjid Kalam@@odinshell, Abhijeet Singh (linkedin.com/in/abhiunix/), Omar Cerrito, Wang Yu(STAR Labs SG Pte), Ji'an Zhou, Mingxuan Yang, Ye Zhang, Jian Zhou, Calif Research, Ernesto Martínez García, Lukas Gerlach, Tristan Rousseau, Dun(DARKNAVY), deepsec@@DarkNavyOrg(DARKNAVY), CVE-2026-4424, Amy (amys.website), He Wei (ギカク)(aipyaipy), 章鱼哥@@aipy(aipyaipy), Jex Amro, Daisuke Hatakeyama Research)@@SYZD, Richard Zana(Nosebeard Labs), yk lin@@pixiepointsec, wh0am1i, Matej Moravec@@MacejkoMoravec, Aethel-Systems(Chongqing Telecom), Chanwit Muenprakoddee (ChemIndy)(Chongqing Telecom), 九宫格(Chongqing Telecom), Narcis Oliveras Fontàs, Francisco Knabe, Zachary Neal(Stripe), Hcamael(Stripe), 章鱼哥 (aipyaipy.com)@@aipy(Stripe), JC Alvarado(Stripe), Jacob Hazak, @@pixiepointsec, Ilya Andr (andrd3v), Junming C.(Chapoly1305), wdszzml, Atuin Automated Vulnerability Discovery Engine, Bob Gendler(the National Institute of Standards), Technology, RedRays Security Team, Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir, He Wei (ギカク)(Cisco Talos), Kitten Food, Calif.io in collaboration with Claude, Anthropic Research, Tien-Chih Lin(CyCraft Technology), Tien-Chih Lin, Bruce Dang(Calif), Kwak Kiyong, Kagami Rosylight(Mozilla), Luke Francis(Z), Francisco Alonso@@revskills(Z), Shubham Chaskar(Z), Jiyong Yang@@Sy2n0(Z), 杉山 壮太(Z), lattice(Z), Behzad Najjarpour Jabbari@@_G4ru_(Z), Junyeong Lee(Z), Mooth.ai(Z), OGINOME Tomohito(Z), Using GLM(Z), Gia Bui@@yabeow(Calif), Milad Nasr, Nicholas Carlini with Claude, Anthropic, Heiko Kiesel(SEEMOO), TU Darmstadt, Brian Carpenter, OGINOME Tomohito, Shaheen Fazim, Rosyna Keller(Totally Not Malicious Software), Adam Franke(CyStack), Ashish Kunwar(CyStack), 이재영(Appknox), Peter Malone(cyberplanet), Nicolas Rabrenovic(cyberplanet), Irvin Wang(cyberplanet), CVE-2025-14017, CVE-2025-14819, Stanislav Jelezoglo(Positive Technologies), Gandalf4a(PKU), Dhiyanesh Selvaraj@@redroot97, hxr1(STAR Labs SG Pte), Hiroki Imai (LAC Co.(STAR Labs SG Pte), Ltd.)(STAR Labs SG Pte), Mahmoud Abdelmoniem(ThreatBook), Hyunwoo Kim@@v4bel(ThreatBook), Vladislav Shevchenko (Positive Technologies)(STAR Labs SG Pte), Kirin@@Pwnrin(Fudan University), LFY@@secsys(Fudan University), Prathamesh Walunj@@attahasa, Atul R V, Dan Raviv, Aethel-Systems, Aaron Grattafiori - NVIDIA AI Red Team, Pyrophoria, Estifanos Megersa, Ahmed Uddin, silo, wdszzml(Bynar), Atuin Automated Vulnerability Discovery Engine(Bynar)

Affected Software

7 affected componentsFixes available
Apple macOS>=14.0<14.8.8
Apple macOS>=15.0<15.7.8
Apple macOS>=26.0<26.6
Apple macOS Tahoe<26.6
26.6
Apple macOS Sequoia<15.7.8
15.7.8
Apple macOS Sonoma<14.8.8
14.8.8
Apple macOS Sequoia<15.8.2
15.8.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 26.6
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.7.8
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 14.8.8
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.8.2
  5. Upgrade

    Upgrade macOS Sequoia to a version that resolves this vulnerability.

    Fixed in 15.7.8
  6. Upgrade

    Upgrade macOS Sequoia to a version that resolves this vulnerability.

    Fixed in 15.8.2
  7. Upgrade

    Upgrade macOS Sonoma to a version that resolves this vulnerability.

    Fixed in 14.8.8
  8. Upgrade

    Upgrade macOS Tahoe to a version that resolves this vulnerability.

    Fixed in 26.6

Event History

Jul 27, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·08:13 PM
Data Sourced
via MITRE·08:13 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2026-64767?

The severity of CVE-2026-64767 is rated critical with a CVSS score of 9.8.

2

What is CVE-2026-64767?

CVE-2026-64767 describes a buffer overflow vulnerability that can lead to unexpected system termination or kernel memory corruption.

3

How do I fix CVE-2026-64767?

To fix CVE-2026-64767, update to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6.

4

Which software is affected by CVE-2026-64767?

CVE-2026-64767 affects Apple macOS, macOS Tahoe, macOS Sequoia, and macOS Sonoma.

5

What type of vulnerability is CVE-2026-64767 classified as?

CVE-2026-64767 is classified as a buffer overflow vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203