The July 2026 Apple Security Update Review

Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month’s 210. Quite a jump.For July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.·      CVE-2026-43818 (ImageIO) – This bug could allow the “Processing [of] a maliciously crafted image may lead to arbitrary code execution." ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It’s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.·      CVE-2026-64747 (AVEVideoEncoder) – According to Apple, “An app may be able to execute arbitrary code with kernel privileges.” Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.·      CVE-2026-64767 (afpfs) – In this case, “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.” This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the “remote attacker” versus “remote user” wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.Honorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi‑Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.Here’s the full table of Apple patches and the products they affect: Apple Security Updates — July 27, 2026 210Total CVEs 9Code Execution 26Elevation of Privilege 11Sandbox Escape 9Security Feature Bypass 15Memory Corruption 55Information Disclosure 2Spoofing / UI 75Denial of Service 8Other Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). "Yes/No" indicates whether each update is affected. CVE IDs link to NVD. CVE ID Component Impact iOS / iPadOS 26.6 macOS Tahoe 26.6 macOS Sequoia 15.7.8 macOS Sonoma 14.8.8 tvOS 26.6 watchOS 26.6 visionOS 26.6 Safari 26.6 CVE-2026-64732 Accessibility An attacker with physical access may be able to access sensitive user data during iPhone Mirroring YesNoNoNoNoNoNoNo CVE-2026-43749 Accounts An app may be able to gain root privileges NoYesYesYesNoNoNoNo CVE-2026-43819 Accounts An app may be able to access sensitive user data NoYesNoNoNoNoNoNo CVE-2026-64733 Accounts Framework An app may be able to fingerprint the user YesYesNoNoYesYesYesNo CVE-2026-64767 afpfs A remote attacker may be able to cause unexpected system termination or corrupt kernel memory NoYesYesYesNoNoNoNo CVE-2026-23918 apache A remote attacker may be able to cause a denial-of-service NoYesYesYesNoNoNoNo CVE-2026-64695 APFS A remote user may be able to cause unexpected system termination or corrupt kernel memory NoYesYesYesNoNoNoNo CVE-2026-43801 App Store An app may be able to access sensitive user data YesYesYesYesYesYesYesNo CVE-2026-43781 Apple Account An app may be able to access sensitive user data NoYesYesYesNoNoNoNo CVE-2026-64737 Apple Account A malicious app may be able to break out of its sandbox NoYesYesYesNoNoNoNo CVE-2026-28928 Apple Neural Engine An app may be able to cause unexpected system termination YesYesNoNoYesYesNoNo CVE-2026-43748 Apple Neural Engine An app may be able to cause unexpected system termination NoYesYesNoNoNoNoNo CVE-2026-43776 AppleDouble Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution YesYesYesNoNoNoNoNo CVE-2026-43681 AppleRAID A local user may be able to read kernel memory NoYesYesYesNoNoNoNo CVE-2026-43672 Assets A malicious application may be able to bypass Privacy preferences NoYesYesYesNoNoNoNo CVE-2026-43763 ATS An app may be able to read files outside of its sandbox NoYesYesYesNoNoNoNo CVE-2026-64702 Audio An app may be abl