CVE-2026-64721

The record

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data.

Affected packages

Related vulnerabilities

• CVE-2026-79603 x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to… CWE-664
• CVE-2026-79289 Improper control of a resource through its lifetime in Workers in Google Chrome prior to… CWE-664
• CVE-2026-18549 @fastify/multipart is a multipart form-data parser for Fastify. CWE-664
• CVE-2026-20158 As part of Cisco's ongoing commitment to proactive security and product quality, the… CWE-664
• CVE-2026-8582 Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote… CWE-664
• CVE-2026-8517 Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168… CWE-664
• GHSA-f9jp-856v-8642 PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state CWE-664