CVE-2026-20669

Modified Modified - Updated After Analysis

Path Validation Flaw in macOS Tahoe Allows Sensitive Data Access

Publication date: 2026-02-11

Last updated on: 2026-02-12

Assigner: Apple Inc.

Description

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.3. An app may be able to access sensitive user data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-11

Last Modified

2026-02-12

Generated

2026-07-06

AI Q&A

2026-02-12

EPSS Evaluated

2026-07-05

NVD

CVE-2026-20669

EUVD

EUVD-2026-6710

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	to 26.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a parsing issue related to the handling of directory paths in macOS Tahoe. It involves improper validation of these paths, which could allow an application to access sensitive user data.

Impact Analysis

An application exploiting this vulnerability may be able to access sensitive user data without proper authorization, potentially leading to privacy breaches or unauthorized data exposure.

Mitigation Strategies

The vulnerability is fixed in macOS Tahoe 26.3 by improved path validation. To mitigate this vulnerability, you should update your macOS Tahoe system to version 26.3 or later.

Compliance Impact

I don't know

Detection Guidance

I don't know

Hi! I’m here to help you understand CVE-2026-20669. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70