# Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)

> Apple patched a local stack-based buffer overflow in Libnotify/notifyd on July 27, 2026 across iOS, iPadOS, tvOS, watchOS, visionOS and macOS. Apple's stated impact is unexpected app termination; code execution would additionally require bypassing the stack canary and arm64e Pointer Authentication, and is theoretical.

- **Published:** 2026-11-11T20:09:23Z
- **Last reviewed:** 2026-11-11T20:09:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5792
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5792.png
- **ID:** TL-2026-5792
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 10
- **CVEs:** CVE-2026-64739

## Description

CVE-2026-64739 is an out-of-bounds write (stack-based buffer overflow) in Libnotify, the client library for Apple's notifyd notification daemon. Apple describes it as 'An out-of-bounds write issue was addressed with improved bounds checking' and states the impact as 'An attacker may be able to cause unexpected app termination'. The fix shipped on July 27, 2026 in iOS 26.6, iPadOS 26.6, tvOS 26.6, watchOS 26.6, visionOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. The Apple advisory credits Feng Xue and XGPT of ThreatBook.

According to ThreatBook's analysis (the component-level root cause is not stated in Apple's advisory text), notifyd does not correctly validate the length of an attacker-controlled path during file-monitor registration before copying it into a fixed-size stack buffer of MAXPATHLEN (1,024 bytes). A local, unprivileged process can trigger the overflow by registering a file-monitor request with an oversized path; no user interaction is needed. The affected function names are not published.

Exploitation barriers: the stack canary appears to catch the corruption, which is consistent with Apple's stated outcome of app termination. Turning the overflow into code execution (and potentially local privilege escalation) would also require defeating arm64e Pointer Authentication Codes (PAC); ThreatBook frames this as a theoretical ceiling, not a demonstrated outcome. There is no evidence of in-the-wild exploitation, no public PoC, no named threat actor and no IOCs in the available sources. Apple published no workaround; remediation is applying the OS update.

Scoring note: the source does not state a CVSS score. A third-party NVD mirror (Appaloosa) shows 8.8 with vector AV:N/UI:R, which conflicts with the local, no-interaction attack path described by ThreatBook and Apple; it is therefore not adopted here. Severity MEDIUM is an analyst estimate. The NVD page itself could not be retrieved, and no CWE is stated in the sources.

## MITRE ATT&CK

- T1499.004 Application or System Exploitation
- T1404 Exploitation for Privilege Escalation
- T1106 Native API
- T1203 Exploitation for Client Execution

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-64739 libnotify/notifyd Stack-Canary Abort Crashes — Exploitation Attempt (TL-2026-5792)** (`TL-2026-5792-SPL-001`)

Detects repeated macOS crash reports showing a SIGABRT caused by __stack_chk_fail with libsystem_notify/libnotify/notifyd frames on the same host. Per Apple and ThreatBook, an oversized (>1024 byte, MAXPATHLEN) path in notifyd file-monitor registration overflows a stack buffer; the stack canary catches the corruption and the observable result is unexpected app termination. This is a behavioural hunting hypothesis, not a documented in-the-wild artifact: no public PoC, no known exploitation. Repeated canary aborts in notify-related frames are a plausible trigger-attempt signal (T1499.004 app/system exploitation DoS; T1203/T1068/T1404 only if a canary + arm64e PAC bypass ever materialises) and also surface fuzzing or buggy clients on unpatched OS builds (fixed in macOS 26.6 / 15.7.8 / 14.8.8).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1499.004, T1499, T1203, T1106, T1068, T1404
- **Data sources:** splunk:index=macos sourcetype=macos:diagnosticreport, macos_crash_reports
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=macos sourcetype="macos:diagnosticreport" earliest=-24h ("__stack_chk_fail" OR "stack_chk_fail") ("libsystem_notify" OR "libnotify" OR "notifyd") ("SIGABRT" OR "EXC_CRASH")
| eval crashed_proc=coalesce(procName, process_name, app_name, "unknown")
| stats count AS crash_count earliest(_time) AS first_seen latest(_time) AS last_seen values(crashed_proc) AS crashed_procs BY host
| where crash_count>=2
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
// CVE-2026-64739 - repeated notifyd crash reports on macOS (Defender for Endpoint)
// Proxy for the stack-canary abort: MDE exposes crash-report file creation, not report content.
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FolderPath has "/Library/Logs/DiagnosticReports"
| where FileName startswith "notifyd" and (FileName endswith ".ips" or FileName endswith ".crash")
| summarize CrashReports=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Files=make_set(FileName, 10) by DeviceId, DeviceName
| where CrashReports >= 2
| project DeviceName, DeviceId, CrashReports, FirstSeen, LastSeen, Files
```

### Sigma

```yaml
title: macOS notifyd Crash Report Created - CVE-2026-64739 Overflow Attempt
id: 5b0e7a3c-6f1d-4c52-9a8e-2d7f4b9c1a01
status: experimental
description: Detects creation of a notifyd crash report in DiagnosticReports. CVE-2026-64739 is a stack buffer overflow in notifyd file-monitor path handling whose observed outcome is a stack-canary abort. Alert on repeated occurrences per host; a single crash is common noise.
references:
  - https://threatbook.io/blog/apple-libnotify-cve-2026-64739
  - https://support.apple.com/en-us/128066
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.impact
  - attack.t1499.004
  - attack.execution
  - attack.t1203
  - attack.t1106
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.64739
logsource:
  product: macos
  category: file_event
detection:
  selection_path:
    TargetFilename|contains: '/Library/Logs/DiagnosticReports/'
  selection_name:
    TargetFilename|contains: 'notifyd'
  selection_ext:
    TargetFilename|endswith:
      - '.ips'
      - '.crash'
  condition: all of selection_*
falsepositives:
  - Unrelated notifyd crashes from OS bugs or unstable beta builds
  - Developer or QA fuzzing of notify APIs
level: medium
```

**Known false positives:**

- Unrelated notifyd or client-app crashes from OS beta builds or third-party software bugs
- Developer or QA fuzzing of the notify API on test Macs

**Tuning notes:** Index and sourcetype names are site-specific: point a Splunk monitor at /Library/Logs/DiagnosticReports and ~/Library/Logs/DiagnosticReports and adjust index/sourcetype and field names (procName). Raise the crash_count threshold or add a 1h window on noisy fleets; exclude developer and QA hosts. Prioritise hosts still below macOS 26.6 / 15.7.8 / 14.8.8. The KQL and Sigma flavours are file-event proxies (crash-report creation) because crash-report content is not available in MDE file telemetry.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-64739 notifyd Restart Loop (Sentinel/MDE) — Exploitation Attempt Aftermath (locked: unlock with TL Creds)
- CVE-2026-64739 notifyd Masquerade — Non-Standard Path or Non-Root Context (Sentinel/MDE) (locked: unlock with TL Creds)
- CVE-2026-64739 notifyd Child Process Network Egress — Tool Download / Reverse Shell (Sentinel/MDE) (locked: unlock with TL Creds)
- CVE-2026-64739 Scripted notify File-Monitor API Use / Oversized Path Argument (Sigma) — Exploit Trigger (locked: unlock with TL Creds)
- CVE-2026-64739 notifyd Writes launchd Persistence Plist (Sigma) — Post-Exploitation (locked: unlock with TL Creds)
- Apple/iCloud Lookalike Domain DNS Lookups on .top/.xyz (Sigma) — Community Campaign Theme for CVE-2026-64739 (locked: unlock with TL Creds)
- notifyd Spawning Shell, Interpreter or Download Utility — Post-Exploitation (CVE-2026-64739) (locked: unlock with TL Creds)
- notifyd Outbound Network Connection — C2 Callback Tripwire (CVE-2026-64739) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Apple Libnotify/notifyd Stack Overflow (CVE-2026-64739), discovered by ThreatBook XGPT](https://threatbook.io/blog/apple-libnotify-cve-2026-64739)
- [Apple security advisory: iOS 26.6 and iPadOS 26.6 (Libnotify, CVE-2026-64739)](https://support.apple.com/en-us/128066)
- [NVD - CVE-2026-64739](https://nvd.nist.gov/vuln/detail/cve-2026-64739)
- [Appaloosa Scout - CVE-2026-64739](https://scout.appaloosa.io/cves/CVE-2026-64739)
- [ThreatInt CVE record - CVE-2026-64739](https://cve.threatint.com/CVE/CVE-2026-64739)
- [Apple security releases index](https://support.apple.com/en-us/100100)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5792