CVE-2026-64726

This is a memory corruption vulnerability in Apple's wireless proximity stack — specifically the code paths handling device-to-device sessions over Bluetooth, WiFi Direct, or AirDrop. The physical proximity requirement is the critical detail: this is not a remote vulnerability. An attacker must be within wireless range of the target device to trigger the memory corruption. The 'improved memory handling' phrasing in Apple's advisory is technically precise — this is a failure in the memory management subsystem, most likely a race condition in how buffer lifetimes are managed during proximity session establishment or device state transitions. This points to a systemic issue in Apple's wireless frameworks where Swift safety guarantees break down at the interface with lower-level C radio protocols. Given the CVSS 9.8 / EPSS 0.00431 divergence: the EPSS is correctly reflecting that active exploitation is unlikely. Physical proximity requirements drastically reduce the attacker population — this isn't a vulnerability you will encounter from random internet scanning. The severity rating reflects impact (memory corruption can lead to code execution), not exploitation probability. Practical guidance: prioritize patching for Apple devices that have Bluetooth, WiFi Direct, or AirDrop enabled in high-traffic enterprise, retail, or government environments where physical proximity to unknown devices is plausible. For devices in controlled settings, this warrants patching but not emergency-level response. The unified codebase (one fix across iOS, iPadOS, tvOS, visionOS, watchOS, and macOS) means the same memory management code runs everywhere — watch tvOS and visionOS updates closely as their proximity APIs are newer and less battle-tested.

Reviewed through automated stages and approved by a human before publication.