CVE-2026-64691 is a buffer overflow in macOS (version 26.6) that allows any application to trigger kernel-level system termination. The CVSS 9.8 rating reflects severity, but the EPSS score of 0.00343 is deceptively low—and that gap should concern you more than reassure you.
The attack vector matters here. For a userspace application to trigger a kernel-level buffer overflow, the vulnerable code must sit at a userspace-kernel boundary—almost certainly an IOKit driver interface, an XPC service, or a Mach port handler. Apple's sparse disclosure ("improved size validation") is actually diagnostic: this phrasing in Apple's patch notes correlates historically with integer truncation or off-by-one bugs in length-computing paths at the IOKit user-kernel interface, particularly in MIG (Mach Interface Generator) codegen where structure deserialization happens before bounds checking. The likely scenario: a sandboxed app sends an XPC message, the MIG stub unpacks it into a kernel buffer, and size validation occurs too late in the sequence.
This changes your prioritization calculus. First, this is likely legacy IOKit code that predates modern memory safety tooling—Apple has been deprecating kernel extensions for years, but the IOKit user-kernel boundary persists for compatibility. If this flaw existed in shipped code, similar patterns almost certainly exist in iOS, tvOS, and watchOS that share the same subsystems. Second, the "app-mediated kernel panic" isn't just a denial-of-service—it leaves filesystem journals in indeterminate states, kext caches may not flush cleanly, and in-kernel security state (Keychain, SIP) could be left inconsistent. Third, the low EPSS likely reflects uncertainty about trigger conditions, not low blast radius. A kernel panic triggerable from any app is fundamentally different from one requiring specific hardware state or privileges.
For your fleet: prioritize this patch aggressively regardless of EPSS. If you run endpoint detection, monitor for unexpected kernel panics correlated with specific third-party applications or developer tools that have broader entitlements. The question isn't whether to patch—it's whether Apple's disclosure silence means similar vulnerabilities are still latent in other IOKit paths your userspace code touches daily.