FHN 
Apple has released iOS 26.6 and iPadOS 26.6, delivering an important set of security updates for supported iPhones and iPads. The release addresses multiple vulnerabilities that could allow attackers to execute code with kernel privileges, gain root access, or bypass Apple’s app sandbox.
The updates are available for iPhone 11 and newer models, along with supported iPads. While Apple has not reported any active exploitation of these vulnerabilities, the nature of the flaws makes this update a high priority for all users.
Critical Vulnerabilities Patched
One of the most serious issues, tracked as CVE-2026-64747, affects the AVEVideoEncoder component. The vulnerability could allow a malicious application to execute arbitrary code with kernel-level privileges through a buffer overflow. Apple resolved the issue by improving input size validation.
The update also fixes several vulnerabilities in the iOS kernel. These flaws could lead to system crashes, kernel memory corruption, sensitive information disclosure, or unauthorized memory access. Apple addressed these issues by strengthening memory handling, improving bounds checking, and resolving race conditions.
Some of the key security fixes include:
- CVE-2026-64747 – Kernel code execution vulnerability in AVEVideoEncoder.
- CVE-2026-28931 – Kernel memory corruption when connecting to a malicious NFS server.
- CVE-2026-43810 – Remote vulnerability that could trigger system crashes or corrupt kernel memory.
- CVE-2026-43723 – Root privilege escalation flaw in MediaRemote.
- CVE-2026-64740 – Sandbox escape vulnerability in Game Center.
- CVE-2026-28973 – Sandbox escape issue in libc caused by an integer overflow.
Additional Security Improvements
Apple also patched several code execution vulnerabilities affecting AppleDouble, ImageIO, and SceneKit. These flaws could be exploited through specially crafted files, images, textures, or 3D content delivered via websites, downloads, email attachments, or malicious applications.
The company also strengthened WebKit, the browser engine used by Safari and many iOS apps. The update fixes issues related to memory disclosure, browser crashes, UI spoofing, iframe sandbox enforcement, and unauthorized file access outside the intended sandbox.
The combination of kernel vulnerabilities, root privilege escalation, code execution, and sandbox escape flaws makes iOS 26.6 one of Apple’s most significant security releases in recent months. Although there is no evidence that these vulnerabilities have been exploited in the wild, installing the update is strongly recommended to keep devices protected.
Users can install the latest update by navigating to Settings → General → Software Update on their iPhone or iPad.
About the Author
