CVE-2026-20700
Analyzed Analyzed - Analysis Complete
Memory Corruption in Apple OS Allows Arbitrary Code Execution

Publication date: 2026-02-11

Last updated on: 2026-03-25

Assigner: Apple Inc.

Description
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-11
Last Modified
2026-03-25
Generated
2026-06-16
AI Q&A
2026-02-12
EPSS Evaluated
2026-06-15
NVD
CVE-2026-20700
EUVD
EUVD-2026-6189
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
apple ipados to 26.3 (exc)
apple iphone_os to 26.3 (exc)
apple macos to 26.3 (exc)
apple tvos to 26.3 (exc)
apple visionos to 26.3 (exc)
apple watchos to 26.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a memory corruption issue that was addressed by improving state management in various Apple operating systems including watchOS, tvOS, macOS Tahoe, visionOS, iOS, and iPadOS. It allows an attacker who has the capability to write to memory to potentially execute arbitrary code on the affected device.

Apple is aware that this issue may have been exploited in a highly sophisticated attack targeting specific individuals on versions of iOS prior to iOS 26.

Impact Analysis

If exploited, this vulnerability could allow an attacker with memory write access to execute arbitrary code on your device. This means the attacker could potentially take control of the device, access sensitive information, or perform unauthorized actions.

Because the attack is sophisticated and targeted, it may specifically affect individuals who are targeted by such attacks, potentially compromising their device security and privacy.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update your Apple devices to the fixed versions: watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3, and iPadOS 26.3.

Applying these updates will address the memory corruption issue and prevent potential arbitrary code execution by attackers.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart