CVE-2026-64775 is an uninitialized memory vulnerability affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The critical detail is its trajectory: an unprivileged third-party application can trigger this flaw to cause system termination at the kernel level. This is not an app crash — it's a path from the sandbox to kernel instability, and that vertical escalation is what warrants the 9.8 CVSS score despite the low EPSS probability.
The simultaneous presence across all six Apple platforms strongly indicates this lives in shared XNU kernel code or a core framework, not a product-specific module. The practical implication: if your environment runs any Apple operating system, you need to check all of them. A MacBook patched but an iPad left unpatched creates the same exposure window an attacker would target.
The 'improved memory handling' language in Apple's advisory is deliberately vague. This matters because you cannot verify the fix depth from the advisory alone. The patch could be minimal explicit initialization or a more substantial architectural change. For your risk assessment, treat this as a hardening-as-patch scenario until you have kernel-level confirmation — the vulnerability is closed but the remediation confidence is lower than usual. Monitor Apple's kernel source commits when available for the actual fix implementation.
One asymmetric risk to watch: Apple's simultaneous CVE disclosure across platforms doesn't guarantee simultaneous patch availability across all release trains. iOS, macOS, and watchOS ship on different cadences. If this lives in shared kernel code, the actual fix deployment may have lagged on some platforms — verify your patch status per operating system individually, not by platform family.
The low EPSS probability likely reflects that uninitialized memory bugs are difficult to trigger reliably without the specific conditions the researcher identified. This doesn't reduce your urgency — it means the exploit path is narrow but real, and a determined attacker who invested in understanding the trigger conditions would have a reliable denial-of-service vector against any unpatched device in your fleet.