Apple has released iOS 26.6 and iPadOS 26.6, a significant security update that addresses numerous vulnerabilities across core operating system components, media frameworks, WebKit, wireless services, and application frameworks.
Released on July 27, 2026, this update is available for iPhone 11 and later models, as well as supported iPads. It should be prioritized for deployment by both consumers and enterprise device administrators.
Apple iOS 26.6 Update Fixes Flaws
The most critical issue addressed in this update is CVE-2026-64747, a buffer overflow vulnerability in AVEVideoEncoder. Apple reported that a malicious application could exploit this flaw to execute arbitrary code with kernel privileges, the highest level of execution within iOS.
Kernel-level execution can compromise core platform protections, allowing attackers to manipulate protected memory, evade application sandboxing, and gain deeper control over the affected device. Apple fixed this vulnerability by improving size validation.
Another significant vulnerability fixed is CVE-2026-43723, which involves path handling in MediaRemote. This flaw could allow a malicious application to gain root privileges.
Gaining root access poses a critical escalation risk, providing unrestricted control over the operating environment and access to system-level resources typically protected from third-party applications. Apple addressed this issue by reinforcing validation in the affected path-handling logic.
The iOS 26.6 release includes an extensive set of kernel security fixes. Several vulnerabilities could allow an application to corrupt or write kernel memory, disclose kernel memory information, trigger unexpected system crashes, or bypass network filters.
Fixed issues include use-after-free conditions, out-of-bounds reads and writes, integer overflows, race conditions, memory initialization defects, and insufficient state handling. Notably, another kernel flaw, CVE-2026-28931, could be triggered by connecting to a malicious NFS server, resulting in kernel memory corruption.
Additional important fixes include an IOKit race condition that could allow an app to write to kernel memory, an AppleDouble buffer overflow enabling arbitrary code execution through a maliciously crafted file, and several SceneKit vulnerabilities that could permit arbitrary code execution when parsing malicious files.
Apple also resolved sandbox-escape vulnerabilities in Game Centre and libc, addressed potential code-signing enforcement bypasses in CloudAttestation, and fixed an ImageIO flaw in which processing a crafted image could lead to arbitrary code execution.
The update also reduces the web-facing attack surface with patches for WebKit, WebKit Canvas, and WebRTC. Issues documented include process memory disclosure, iframe sandbox policy violations, UI spoofing, cross-sandbox file access, Safari crashes, and denial-of-service conditions caused by malicious web content.
Additionally, it addresses a proximity-based Wi-Fi flaw that could corrupt process memory and an iPhone mirroring issue that could allow a physically present attacker to access sensitive user data.
Organizations should immediately deploy iOS 26.6 and iPadOS 26.6 through their mobile device management (MDM) platforms, enforce minimum OS version compliance, and monitor for devices that remain unpatched.
Individual users can install the update by navigating to Settings > General > Software Update. While Apple has not indicated that the listed vulnerabilities were actively exploited, the existence of fixes for kernel code execution and root escalation underscores the importance of rapid patching.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
