--- id: "CVE-2026-64781" page: "https://infrastack.ai/live/CVE-2026-64781" kind: "vulnerability" aliases: ["CVE-2026-64781"] title: "The issue was addressed with improved input validation" severity: "medium" cvss: 4.3 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "apple ipados", "fixed": ["18.7.10"], "affected": "< 18.7.10", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["26.6.1"], "affected": ">= 26.0, < 26.6.1", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["18.7.10"], "affected": "< 18.7.10", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.6.1"], "affected": ">= 26.0, < 26.6.1", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.6.2"], "affected": ">= 26.0, < 26.6.2", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "apple-vision-pro", "vendor", "vendor-advisory", "visionos"] not_affected_if: [] published_at: "2026-08-17T22:17:23+00:00" first_seen_at: "2026-11-10T00:17:05+00:00" updated_at: "2026-11-10T00:28:45+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149038", "first_seen_at": "2026-11-10T00:17:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64781", "first_seen_at": "2026-11-10T00:28:45+00:00"}] exploit_sources: [] --- # The issue was addressed with improved input validation Link for people: https://infrastack.ai/live/CVE-2026-64781 (this .md is for agents) This is Apple's security content page for visionOS 27, listing many flaws across system components such as CoreMedia, Bluetooth and AVEVideoEncoder. The excerpt given does not show what CVE-2026-64781 itself is, so the impact of this specific ID is unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple ipados affected < 18.7.10 fixed 18.7.10 - vendor:apple ipados affected >= 26.0, < 26.6.1 fixed 26.6.1 - vendor:apple iphone os affected < 18.7.10 fixed 18.7.10 - vendor:apple iphone os affected >= 26.0, < 26.6.1 fixed 26.6.1 - vendor:apple macos affected >= 26.0, < 26.6.2 fixed 26.6.2 ## How to check - Check the visionOS version on the device in Settings > General > About. - Compare against the release listed on the Apple security releases page. ## Timeline - 2026-11-10T00:17:05+00:00 lab https://support.apple.com/en-us/149038 — Apple: About the security content of visionOS 27 - Apple Support - 2026-11-10T00:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64781 ## Documents - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/148281 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/148282 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/148287 - [mentions] Apple: About the security content of visionOS 27 - Apple Support https://support.apple.com/en-us/149038 ## From the sources About the security content of visionOS 27 - Apple Support # About the security content of visionOS 27 This document describes the security content of visionOS 27. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## visionOS 27 Released September 14, 2026 ### Accelerate Framework Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may lead to unexpected process termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86882: Peter Malone ### Accelerate Framework Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86918: Arni Hardarson (Neonix Security) Entry added October 19, 2026 ### APFS Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84523: Cem Onat Karagun, an anonymous researcher ### App Intents Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved access restrictions. CVE-2026-84582: Zhongcheng Li (CK01) Entry added October 19, 2026 ### App Store Available for: Apple Vision Pro (all models) Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. CVE-2026-86888: Zhongcheng Li (CK01) ### Apple Account Available for: Apple Vision Pro (all models) Impact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account Description: An authentication issue was addressed with improved state management. CVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal Singh, Lehan Dilusha Jayasingha (Sri Lanka) ### Apple Intelligence Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-86920: Johan Wahyudi Entry added October 26, 2026 ### Apple Neural Engine Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A race condition was addressed with additional validation. CVE-2026-84634: S. Rosario Entry added October 26, 2026 ### Apple Neural Engine Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84595: tamdao Entry added October 26, 2026 ### AppleAVD Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65407: Franco Belman at Blackwing Intelligence ### Audio Available for: Apple Vision Pro (all models) Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin ### Authentication Services Available for: Apple Vision Pro (all models) Impact: An app may be able to delete credentials stored in Keychain Description: This issue was addressed by removing the vulnerable code. CVE-2026-86905: Ilya Andr (andrd3v) ### AuthKit Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. CVE-2026-84583: Zhongcheng Li from IES Red Team ### AVEVideoEncoder Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved checks. CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research ### AVEVideoEncoder Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-84616: Peter Malone ### AVEVideoEncoder Impact: A sandboxed app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved state management. CVE-2026-84607: Ruslan Dautov ### BackgroundAssets Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A logic issue was addressed with improved validation. CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security ### Bluetooth Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. ### Bluetooth Impact: An app may gain unauthorized access to Bluetooth Description: An authorization issue was addressed with improved state management. CVE-2026-84560: an anonymous researcher ### Bluetooth Impact: An attacker in radio range may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84613: jioundai Entry added October 19, 2026 ### CloudKit Available for: Apple Vision Pro (all models) Impact: A local app may be able to read a persistent account identifier Description: An information disclosure issue was addressed with improved state management. CVE-2026-86895: Stanislav Jelezoglo ### CloudKit Impact: An app may be able to read device name Description: A permissions issue was addressed with additional restrictions. CVE-2026-86893: Heiner Gerdes ### copyfile Available for: Apple Vision Pro (all models) Impact: An archive may be able to bypass Gatekeeper Description: A file quarantine bypass was addressed with additional checks. CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher ### copyfile Available for: Apple Vision Pro (all models) Impact: An app may be able to modify protected parts of the file system CVE-2026-86966: Jihwan Yoon Entry added October 26, 2026 ### Core Bluetooth Impact: An attacker with a paired Bluetooth device may be able to execute arbitrary code Description: A stack overflow was addressed with improved input validation. CVE-2026-86919: Mathis Mansière Entry added October 19, 2026 ### Core Bluetooth Impact: Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112608: Duc Anh Nguyen & Ta Duc Thien Entry added October 26, 2026 ### CoreMedia Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A memory corruption issue was addressed by removing the vulnerable code. CVE-2026-64752: Nik Tsytsarkin ### CoreMedia Impact: A sandboxed process may be able to circumvent sandbox restrictions Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86876: Chris Bailey - Short Circuit ### CoreMedia Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-65344: Siyeong kim ### CoreMedia Available for: Apple --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_