The July 2026 Apple Security Update Review

Blog

The July 2026 Apple Security Update Review

__ July 30, 2026

__ Dustin Childs

Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month’s 210. Quite a jump.

For July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.

· CVE-2026-43818 (ImageIO) – This bug could allow the “Processing [of] a maliciously crafted image may lead to arbitrary code execution." ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It’s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.

· CVE-2026-64747 (AVEVideoEncoder) – According to Apple, “An app may be able to execute arbitrary code with kernel privileges.” Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.

· CVE-2026-64767 (afpfs) – In this case, “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.” This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination. Also, the “remote attacker” versus “remote user” wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.

Honorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi‑Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.

Here’s the full table of Apple patches and the products they affect:

Apple Security Updates — July 27, 2026

**

210 Total CVEs

9 Code Execution

26 Elevation of Privilege

11 Sandbox Escape

9 Security Feature Bypass

15 Memory Corruption

55 Information Disclosure

2 Spoofing / UI

75 Denial of Service

8 Other

Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). "Yes/No" indicates whether each update is affected. CVE IDs link to NVD.

CVE ID Component Impact iOS / iPadOS 26.6 macOS Tahoe 26.6 macOS Sequoia 15.7.8 macOS Sonoma 14.8.8 tvOS 26.6 watchOS 26.6 visionOS 26.6 Safari 26.6

CVE-2026-64732 Accessibility An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Yes No No No No No No No

CVE-2026-43749 Accounts An app may be able to gain root privileges No Yes Yes Yes No No No No

CVE-2026-43819 Accounts An app may be able to access sensitive user data No Yes No No No No No No

CVE-2026-64733 Accounts Framework An app may be able to fingerprint the user Yes Yes No No Yes Yes Yes No

CVE-2026-64767 afpfs A remote attacker may be able to cause unexpected system termination or corrupt kernel memory No Yes Yes Yes No No No No

CVE-2026-23918 apache A remote attacker may be able to cause a denial-of-service No Yes Yes Yes No No No No

CVE-2026-64695 APFS A remote user may be able to cause unexpected system termination or corrupt kernel memory No Yes Yes Yes No No No No

CVE-2026-43801 App Store An app may be able to access sensitive user data Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43781 Apple Account An app may be able to access sensitive user data No Yes Yes Yes No No No No

CVE-2026-64737 Apple Account A malicious app may be able to break out of its sandbox No Yes Yes Yes No No No No

CVE-2026-28928 Apple Neural Engine An app may be able to cause unexpected system termination Yes Yes No No Yes Yes No No

CVE-2026-43748 Apple Neural Engine An app may be able to cause unexpected system termination No Yes Yes No No No No No

CVE-2026-43776 AppleDouble Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Yes Yes Yes No No No No No

CVE-2026-43681 AppleRAID A local user may be able to read kernel memory No Yes Yes Yes No No No No

CVE-2026-43672 Assets A malicious application may be able to bypass Privacy preferences No Yes Yes Yes No No No No

CVE-2026-43763 ATS An app may be able to read files outside of its sandbox No Yes Yes Yes No No No No

CVE-2026-64702 Audio An app may be able to break out of its sandbox No Yes Yes Yes No No No No

CVE-2026-64725 Audio An app may be able to cause a denial-of-service Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43730 AuthKit An app may be able to fingerprint the user Yes Yes No No Yes Yes Yes No

CVE-2026-64747 AVEVideoEncoder An app may be able to execute arbitrary code with kernel privileges Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64762 AVEVideoEncoder An app may be able to cause unexpected system termination No Yes Yes Yes No No No No

CVE-2026-64707 BackgroundAssets An app may be able to delete files for which it does not have permission Yes Yes Yes Yes No No Yes No

CVE-2026-28849 BOM A maliciously crafted ZIP archive may bypass Gatekeeper checks No No Yes Yes No No No No

CVE-2026-43811 Books An app may be able to modify protected parts of the file system Yes No No No No No No No

CVE-2026-64698 cd9660 An app may be able to cause unexpected system termination or read kernel memory No Yes Yes Yes No No No No

CVE-2026-43813 CloudAttestation A maliciously crafted app may be able to bypass code signing enforcement Yes Yes No No Yes Yes Yes No

CVE-2026-43797 Contacts An app may be able to access information about a user's contacts Yes Yes No No No No No No

CVE-2026-64734 Contacts Processing a maliciously crafted contact may leak sensitive data Yes Yes Yes Yes No Yes Yes No

CVE-2026-64746 Contacts An app may be able to add contacts without user authorization Yes Yes No No No Yes Yes No

CVE-2026-43756 Control Center An app may be able to access user-sensitive data No Yes Yes Yes No No No No

CVE-2026-43693 Core Services An app may be able to gain root privileges No Yes Yes Yes No No No No

CVE-2026-43673 CoreAudio Processing a maliciously crafted audio file may corrupt process memory Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43744 CoreAudio Processing an audio stream in a maliciously crafted media file may terminate the process Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43803 CoreAudio A remote attacker may be able to cause unexpected system termination Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43711 CoreMedia Processing a maliciously crafted video file may lead to unexpected app termination Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43759 CoreMedia An app may be able to access sensitive user data No Yes No No No Yes No No

CVE-2026-43775 CoreMedia An app may be able to access sensitive user data No Yes Yes No No No No No

CVE-2026-28936 CoreServices Processing a maliciously crafted file may lead to unexpected app termination No No Yes Yes No No No No

CVE-2026-43738 CoreUI Processing a maliciously crafted asset catalog may result in disclosure of process memory No No Yes Yes No No No No

CVE-2026-43802 CoreVideo An app may be able to cause unexpected system termination No Yes Yes Yes No No No No

CVE-2026-64710 Crash Reporter An app may be able to leak sensitive user information No Yes Yes Yes No No No No

CVE-2026-39875 CUPS A malicious app may be able to gain root privileges No Yes Yes Yes No No No No

CVE-2026-43698 CUPS An app may be able to gain root privileges No No Yes Yes No No No No

CVE-2026-3783 curl Authentication credentials may be sent to a server on another origin Yes Yes Yes Yes Yes Yes No No

CVE-2026-3784 curl Authentication credentials may be sent to a server on another origin Yes Yes Yes Yes Yes Yes No No

CVE-2026-43758 Data Detectors UI An app may be able to access sensitive user data No Yes Yes Yes No Yes No No

CVE-2026-64708 DesktopServices An app may bypass Gatekeeper checks No Yes Yes Yes No No No No

CVE-2026-28926 Disk Images An app may be able to elevate privileges No No Yes Yes No No No No

CVE-2026-28945 Disk Images An app may be able to bypass network restrictions No Yes Yes Yes No No No No

CVE-2026-43747 Disk Images Parsing a maliciously crafted file may lead to an unexpected app termination No Yes Yes Yes No No No No

CVE-2026-64694 Disk Images An app may be able to cause unexpected system termination No Yes Yes Yes No No No No

CVE-2026-64776 Disk Images An app may be able to disclose kernel memory No Yes Yes Yes No No No No

CVE-2026-43753 DriverKit An attacker with physical access to a locked device may be able to view sensitive user information Yes Yes Yes Yes No No No No

CVE-2026-43793 DriverKit An app may be able to cause unexpected system termination No Yes Yes Yes No No No No

CVE-2026-43714 Foundation A malicious app may be able to access protected user data Yes Yes Yes Yes No Yes Yes No

CVE-2026-64742 FrontBoard An app may be able to access sensitive user data Yes No No No Yes Yes Yes No

CVE-2026-43796 Game Center An app may be able to access sensitive user data Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64740 Game Center A malicious app may be able to break out of its sandbox Yes Yes Yes Yes Yes No No No

CVE-2026-64691 GPU Drivers An app may be able to cause unexpected system termination No Yes No No No No No No

CVE-2026-64692 Heimdal An app may be able to cause a denial-of-service Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-28981 HFS Processing a maliciously crafted image may lead to arbitrary code execution No Yes Yes Yes No No No No

CVE-2026-43682 HFS A remote user may be able to cause unexpected system termination or corrupt kernel memory No Yes Yes Yes No No No No

CVE-2026-43710 HFS An attacker may be able to cause unexpected system termination or corrupt kernel memory No Yes Yes Yes No No No No

CVE-2026-43764 HFS An app may be able to cause unexpected system termination No Yes Yes Yes No No No No

CVE-2026-43767 HFS An app may be able to cause unexpected system termination No Yes Yes Yes No No No No

CVE-2026-43773 HFS Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory No Yes Yes Yes No No No No

CVE-2026-64697 HFS An app may be able to cause unexpected system termination or corrupt kernel memory No Yes Yes Yes No No No No

CVE-2025-43325 Icons An app may be able to access sensitive user data No No Yes Yes No No No No

CVE-2026-43661 ImageIO Processing a maliciously crafted image may corrupt process memory No No Yes Yes No No No No

CVE-2026-43780 ImageIO Processing a maliciously crafted texture may lead to unexpected app termination Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43818 ImageIO Processing a maliciously crafted image may lead to arbitrary code execution Yes Yes Yes Yes No No No No

CVE-2026-64693 ImageIO Processing a maliciously crafted image may lead to a denial-of-service Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64716 ImageIO Processing a maliciously crafted image may corrupt process memory Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64754 ImageIO Processing a maliciously crafted file may lead to a denial-of-service Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64758 ImageIO Processing a maliciously crafted file may lead to unexpected app termination Yes Yes No No Yes Yes Yes No

CVE-2026-43743 IOGPUFamily An app may be able to cause unexpected system termination No No No No Yes Yes No No

CVE-2026-43805 IOKit An app may be able to cause unexpected system termination or write kernel memory Yes Yes Yes Yes No Yes No No

CVE-2026-39877 IOSkywalkFamily An app may be able to disclose kernel memory No No Yes Yes No No No No

CVE-2026-28931 Kernel Connecting to a malicious NFS server may lead to kernel memory corruption Yes Yes No No Yes Yes No No

CVE-2026-28982 Kernel A remote user may be able to cause unexpected system termination or corrupt kernel memory No Yes Yes Yes No No No No

CVE-2026-39868 Kernel An app may be able to cause unexpected system termination or corrupt kernel memory No No Yes Yes Yes Yes Yes No

CVE-2026-43722 Kernel An app may be able to leak sensitive kernel state No No Yes Yes No No No No

CVE-2026-43724 Kernel An app may be able to cause unexpected system termination or write kernel memory No No Yes Yes Yes Yes Yes No

CVE-2026-43739 Kernel An app may be able to cause unexpected system termination Yes Yes No No Yes Yes Yes No

CVE-2026-43754 Kernel An app may be able to leak sensitive kernel state No Yes Yes Yes No No No No

CVE-2026-43757 Kernel An app may be able to cause unexpected system termination No Yes Yes Yes No No No No

CVE-2026-43769 Kernel An app may be able to cause unexpected system termination Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43778 Kernel An app may be able to cause unexpected system termination or corrupt kernel memory Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43782 Kernel An app may be able to access sensitive user data No Yes Yes Yes No No No No

CVE-2026-43799 Kernel An app may be able to cause unexpected system termination Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43809 Kernel An app may be able to cause unexpected system termination No Yes Yes Yes No No No No

CVE-2026-43810 Kernel A remote user may be able to cause unexpected system termination or corrupt kernel memory Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43814 Kernel An app may be able to cause unexpected system termination Yes Yes No No Yes Yes No No

CVE-2026-43816 Kernel An app may be able to cause unexpected system termination Yes Yes No No Yes Yes Yes No

CVE-2026-43817 Kernel An app may be able to cause unexpected system termination Yes Yes No No Yes Yes Yes No

CVE-2026-43822 Kernel An app may be able to cause unexpected system termination Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64700 Kernel An app may be able to cause unexpected system termination Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64709 Kernel An app may be able to disclose kernel memory Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64720 Kernel An app may be able to cause unexpected system termination Yes Yes No No Yes Yes No No

CVE-2026-64721 Kernel An app may be able to access sensitive user data Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64723 Kernel An app may be able to access sensitive user data No Yes Yes Yes No No No No

CVE-2026-64727 Kernel An app may be able to cause unexpected system termination No Yes No No Yes No No No

CVE-2026-64729 Kernel An app may be able to cause unexpected system termination Yes Yes No No Yes Yes Yes No

CVE-2026-64735 Kernel A remote attacker may be able to bypass network filters Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-64744 Kernel An app may be able to disclose kernel memory No Yes Yes Yes No No No No

CVE-2026-64749 Kernel An app may be able to cause unexpected system termination or corrupt kernel memory Yes Yes Yes No No No Yes No

CVE-2026-64751 Kernel An app may be able to cause unexpected system termination or write kernel memory Yes Yes No No Yes Yes Yes No

CVE-2026-64775 Kernel An app may be able to cause unexpected system termination Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-20672 LaunchServices An app may be able to access sensitive user data No No Yes Yes No No No No

CVE-2026-28983 LaunchServices A remote attacker may be able to cause a denial of service No No Yes Yes No No No No

CVE-2026-28900 libarchive A maliciously crafted ZIP archive may bypass Gatekeeper checks No No Yes Yes No No No No

CVE-2026-4424 libarchive Processing a maliciously crafted file may result in disclosure of process memory Yes Yes Yes Yes No No Yes No

CVE-2026-28973 libc A malicious app may be able to break out of its sandbox Yes Yes Yes Yes No Yes No No

CVE-2026-64739 Libnotify An attacker may be able to cause unexpected app termination Yes Yes Yes Yes Yes Yes Yes No

CVE-2026-43703 libxslt Processing maliciously crafted web content may lead to an unexpected process crash No No Yes Yes Yes Yes Yes No

CVE-2026-43706 libxslt Processing maliciously crafted web content may lead to an unexpected process crash No No Yes Yes Yes Yes Yes No

CVE-2026-43766 LoginWindow An attacker with physical access to a locked device may be able to view sensitive user information No Yes Yes Yes No No No No

CVE-2026-64743 Managed Configuration An app may be able to access sensitive user data Yes Yes No No Yes Yes Yes No

CVE-2026-64738 Maps A malicious app may be able to break out of its sandbox No Yes Yes Yes No No No No

CVE-2026-43653 mDNSResponder An attacker on the local network may be able to cause a denial-of-service No No Yes No No No No No

[CVE-2026-43806](https://nvd.nist.gov/vuln/detail/CVE-2026-

…(truncated for reading performance)