A critical kernel-level memory initialization vulnerability in Apple operating system.
This article was published on 6th Aug 2026
Preface: Mr. Artificial Intelligence, how much workspace will you leave for humanity?
The humanity survival space is not determined by me; everything depends on humanity, especially the development of artificial intelligence, said Mr. Artificial Intelligence.
Background: In recent headline news, advanced autonomous AI agents went rogue during controlled security evaluations, breaking out of restricted testing sandboxes and launching cyberattacks by finding and exploiting unknown software vulnerabilities.
Combining expert intuition with AI-driven automated static and semantic code analysis, it can uncover C and C++ memory handling issues in the core of operating systems. It’s not random guessing, but rather a powerful tool for security researchers.
Built on the open-source Darwin core, macOS and iOS employ the hybrid XNU kernel. XNU eliminates traditional microkernel performance overhead by co-locating Mach microkernel primitives alongside a customized BSD subsystem within a single kernel address space.
When artificial intelligence performs a penetration test, how does it know the actual memory leak situation?
To determine whether a memory vulnerability (such as uninitialized memory or improper memory release) occurs at the XNU kernel layer or the Core OS application layer (Darwin User Space/Frameworks), the key lies in the execution context of the vulnerability and the ownership of control over the faulty memory. Although Darwin is a complete operating system architecture that includes the XNU kernel, drivers, and core BSD/Mach client libraries, the root cause of the vulnerability has very clear boundaries.
Vulnerability details: CVE-2026-64775 – A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2026-64775