CVE-2026-20700

Analyzed Analyzed - Analysis Complete

Memory Corruption in Apple OS Allows Arbitrary Code Execution

Publication date: 2026-02-11

Last updated on: 2026-03-25

Assigner: Apple Inc.

Description

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-11

Last Modified

2026-03-25

Generated

2026-07-06

AI Q&A

2026-02-12

EPSS Evaluated

2026-07-05

NVD

CVE-2026-20700

EUVD

EUVD-2026-6189

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 26.3 (exc)
apple	iphone_os	to 26.3 (exc)
apple	macos	to 26.3 (exc)
apple	tvos	to 26.3 (exc)
apple	visionos	to 26.3 (exc)
apple	watchos	to 26.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory corruption issue that was addressed by improving state management in various Apple operating systems including watchOS, tvOS, macOS Tahoe, visionOS, iOS, and iPadOS. It allows an attacker who has the capability to write to memory to potentially execute arbitrary code on the affected device.

Apple is aware that this issue may have been exploited in a highly sophisticated attack targeting specific individuals on versions of iOS prior to iOS 26.

Impact Analysis

If exploited, this vulnerability could allow an attacker with memory write access to execute arbitrary code on your device. This means the attacker could potentially take control of the device, access sensitive information, or perform unauthorized actions.

Because the attack is sophisticated and targeted, it may specifically affect individuals who are targeted by such attacks, potentially compromising their device security and privacy.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update your Apple devices to the fixed versions: watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3, and iPadOS 26.3.

Applying these updates will address the memory corruption issue and prevent potential arbitrary code execution by attackers.

Hi! I’m here to help you understand CVE-2026-20700. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70