Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5792 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-64739 libnotify/notifyd Stack-Canary Abort Crashes — Exploitation Attempt (TL-2026-5792)

Detects repeated macOS crash reports showing a SIGABRT caused by __stack_chk_fail with libsystem_notify/libnotify/notifyd frames on the same host. Per Apple and ThreatBook, an oversized (>1024 byte, MAXPATHLEN) path in notifyd file-monitor registration overflows a stack buffer; the stack canary catches the corruption and the observable result is unexpected app termination. This is a behavioural hunting hypothesis, not a documented in-the-wild artifact: no public PoC, no known exploitation. Repeated canary aborts in notify-related frames are a plausible trigger-attempt signal (T1499.004 app/system exploitation DoS; T1203/T1068/T1404 only if a canary + arm64e PAC bypass ever materialises) and also surface fuzzing or buggy clients on unpatched OS builds (fixed in macOS 26.6 / 15.7.8 / 14.8.8).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1499.004, T1499, T1203, T1106, T1068, T1404
• Data sources: splunk:index=macos sourcetype=macos:diagnosticreport, macos_crash_reports
• Severity: medium
• Confidence: medium

Splunk SPL

index=macos sourcetype="macos:diagnosticreport" earliest=-24h ("__stack_chk_fail" OR "stack_chk_fail") ("libsystem_notify" OR "libnotify" OR "notifyd") ("SIGABRT" OR "EXC_CRASH")
| eval crashed_proc=coalesce(procName, process_name, app_name, "unknown")
| stats count AS crash_count earliest(_time) AS first_seen latest(_time) AS last_seen values(crashed_proc) AS crashed_procs BY host
| where crash_count>=2
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// CVE-2026-64739 - repeated notifyd crash reports on macOS (Defender for Endpoint)
// Proxy for the stack-canary abort: MDE exposes crash-report file creation, not report content.
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FolderPath has "/Library/Logs/DiagnosticReports"
| where FileName startswith "notifyd" and (FileName endswith ".ips" or FileName endswith ".crash")
| summarize CrashReports=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Files=make_set(FileName, 10) by DeviceId, DeviceName
| where CrashReports >= 2
| project DeviceName, DeviceId, CrashReports, FirstSeen, LastSeen, Files

Sigma

title: macOS notifyd Crash Report Created - CVE-2026-64739 Overflow Attempt
id: 5b0e7a3c-6f1d-4c52-9a8e-2d7f4b9c1a01
status: experimental
description: Detects creation of a notifyd crash report in DiagnosticReports. CVE-2026-64739 is a stack buffer overflow in notifyd file-monitor path handling whose observed outcome is a stack-canary abort. Alert on repeated occurrences per host; a single crash is common noise.
references:
  - https://threatbook.io/blog/apple-libnotify-cve-2026-64739
  - https://support.apple.com/en-us/128066
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.impact
  - attack.t1499.004
  - attack.execution
  - attack.t1203
  - attack.t1106
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.64739
logsource:
  product: macos
  category: file_event
detection:
  selection_path:
    TargetFilename|contains: '/Library/Logs/DiagnosticReports/'
  selection_name:
    TargetFilename|contains: 'notifyd'
  selection_ext:
    TargetFilename|endswith:
      - '.ips'
      - '.crash'
  condition: all of selection_*
falsepositives:
  - Unrelated notifyd crashes from OS bugs or unstable beta builds
  - Developer or QA fuzzing of notify APIs
level: medium

Known false positives:

• Unrelated notifyd or client-app crashes from OS beta builds or third-party software bugs
• Developer or QA fuzzing of the notify API on test Macs

Tuning notes: Index and sourcetype names are site-specific: point a Splunk monitor at /Library/Logs/DiagnosticReports and ~/Library/Logs/DiagnosticReports and adjust index/sourcetype and field names (procName). Raise the crash_count threshold or add a 1h window on noisy fleets; exclude developer and QA hosts. Prioritise hosts still below macOS 26.6 / 15.7.8 / 14.8.8. The KQL and Sigma flavours are file-event proxies (crash-report creation) because crash-report content is not available in MDE file telemetry.

• 🔒 CVE-2026-64739 notifyd Restart Loop (Sentinel/MDE) — Exploitation Attempt Aftermath · unlock with TL Creds
• 🔒 CVE-2026-64739 notifyd Masquerade — Non-Standard Path or Non-Root Context (Sentinel/MDE) · unlock with TL Creds
• 🔒 CVE-2026-64739 notifyd Child Process Network Egress — Tool Download / Reverse Shell (Sentinel/MDE) · unlock with TL Creds
• 🔒 CVE-2026-64739 Scripted notify File-Monitor API Use / Oversized Path Argument (Sigma) — Exploit Trigger · unlock with TL Creds
• 🔒 CVE-2026-64739 notifyd Writes launchd Persistence Plist (Sigma) — Post-Exploitation · unlock with TL Creds
• 🔒 Apple/iCloud Lookalike Domain DNS Lookups on .top/.xyz (Sigma) — Community Campaign Theme for CVE-2026-64739 · unlock with TL Creds
• 🔒 notifyd Spawning Shell, Interpreter or Download Utility — Post-Exploitation (CVE-2026-64739) · unlock with TL Creds
• 🔒 notifyd Outbound Network Connection — C2 Callback Tripwire (CVE-2026-64739) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5792.

Technical analysis

CVE-2026-64739 is an out-of-bounds write (stack-based buffer overflow) in Libnotify, the client library for Apple's notifyd notification daemon. Apple describes it as 'An out-of-bounds write issue was addressed with improved bounds checking' and states the impact as 'An attacker may be able to cause unexpected app termination'. The fix shipped on July 27, 2026 in iOS 26.6, iPadOS 26.6, tvOS 26.6, watchOS 26.6, visionOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. The Apple advisory credits Feng Xue and XGPT of ThreatBook.

According to ThreatBook's analysis (the component-level root cause is not stated in Apple's advisory text), notifyd does not correctly validate the length of an attacker-controlled path during file-monitor registration before copying it into a fixed-size stack buffer of MAXPATHLEN (1,024 bytes). A local, unprivileged process can trigger the overflow by registering a file-monitor request with an oversized path; no user interaction is needed. The affected function names are not published.

Exploitation barriers: the stack canary appears to catch the corruption, which is consistent with Apple's stated outcome of app termination. Turning the overflow into code execution (and potentially local privilege escalation) would also require defeating arm64e Pointer Authentication Codes (PAC); ThreatBook frames this as a theoretical ceiling, not a demonstrated outcome. There is no evidence of in-the-wild exploitation, no public PoC, no named threat actor and no IOCs in the available sources. Apple published no workaround; remediation is applying the OS update.

Scoring note: the source does not state a CVSS score. A third-party NVD mirror (Appaloosa) shows 8.8 with vector AV:N/UI:R, which conflicts with the local, no-interaction attack path described by ThreatBook and Apple; it is therefore not adopted here. Severity MEDIUM is an analyst estimate. The NVD page itself could not be retrieved, and no CWE is stated in the sources.

MITRE ATT&CK techniques by tactic:

Execution

T1106 Native API; T1203 Exploitation for Client Execution

privilege-escalation

T1404 Exploitation for Privilege Escalation

Impact

T1499.004 Application or System Exploitation

Remediation

Patches

• iOS 26.6 / iPadOS 26.6
• tvOS 26.6 / watchOS 26.6 / visionOS 26.6
• macOS Tahoe 26.6 / Sequoia 15.7.8 / Sonoma 14.8.8

Immediate actions

• Update iOS/iPadOS, tvOS, watchOS and visionOS to 26.6 or later
• Update macOS to Tahoe 26.6, Sequoia 15.7.8 or Sonoma 14.8.8 or later

Workarounds

• None published by Apple

Longer-term hardening

• Track Apple security releases in patch-compliance reporting for managed Apple fleets
• Monitor endpoint crash telemetry for repeated notifyd or client-app crashes

Affected and fixed versions

• Apple — iOS and iPadOS
  Vulnerable versions: < 26.6
  Fixed in: 26.6
• Apple — tvOS
  Vulnerable versions: < 26.6
  Fixed in: 26.6
• Apple — watchOS
  Vulnerable versions: < 26.6
  Fixed in: 26.6
• Apple — visionOS
  Vulnerable versions: < 26.6
  Fixed in: 26.6
• Apple — macOS Sonoma
  Vulnerable versions: < 14.8.8
  Fixed in: 14.8.8
• Apple — macOS Sequoia
  Vulnerable versions: < 15.7.8
  Fixed in: 15.7.8
• Apple — macOS Tahoe
  Vulnerable versions: < 26.6
  Fixed in: 26.6

Timeline

• 2026-07-27 Appaloosa Scout mirrored the NVD record the same day with a CVSS 3.1 score of 8.8 (AV:N/UI:R) and EPSS 0.52% (44.2nd percentile); no KEV listing or public exploit noted. The network/user-interaction vector conflicts with the local, no-interaction path in Apple and ThreatBook sources.
• 2026-07-27 Apple advisory credits Feng Xue and XGPT of ThreatBook for discovering and reporting the flaw.
• 2026-07-27 CVE-2026-64739 published to NVD with Apple as the source; description: out-of-bounds write addressed with improved bounds checking.
• 2026-07-27 Apple released iOS 26.6, iPadOS 26.6, tvOS 26.6, watchOS 26.6, visionOS 26.6, macOS Tahoe 26.6, Sequoia 15.7.8 and Sonoma 14.8.8 fixing CVE-2026-64739 in Libnotify.
• 2026-07-28 ThreatBook assessed no evidence of in-the-wild exploitation or public PoC, with code execution requiring stack-canary and arm64e PAC bypass; recommended applying the OS update with no separate workaround.
• 2026-07-28 ThreatBook published its analysis attributing the flaw to notifyd file-monitor path handling copying into a 1,024-byte (MAXPATHLEN) stack buffer, and cataloged the CVE in its vulnerability intelligence.
• 2026-09-14 Apple's advisory page 128066 for iOS 26.6 / iPadOS 26.6 shows a published date of September 14, 2026 (release date July 27, 2026); the Libnotify entry carries no added/updated label.

Sources cited

• Apple security advisory: iOS 26.6 and iPadOS 26.6 (Libnotify, CVE-2026-64739) Apple · Advisory · 2026-07-27
• NVD - CVE-2026-64739 NVD (NIST) · Advisory · 2026-07-27
• Appaloosa Scout - CVE-2026-64739 scout.appaloosa.io · Research · 2026-07-27
• ThreatInt CVE record - CVE-2026-64739 cve.threatint.com · Research · 2026-07-27
• Apple security releases index Apple · Vendor report · 2026-07-27
• Apple Libnotify/notifyd Stack Overflow (CVE-2026-64739), discovered by ThreatBook XGPT threatbook.io · Blog · 2026-07-28

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)