Product:
watchOS, tvOS, macOS, iOS, iPadOS, visionOS
Summary
The issue was addressed with improved memory handling. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents. This issue is fixed in multiple versions of Apple’s operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.4 | CVE-2026-20609 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file and convince a user to open it on a vulnerable device. The attack requires local access to the device and user interaction, making it less likely to be exploited remotely. Once the file is processed, it may lead to a denial-of-service condition or expose sensitive memory contents.
Affected Products
- watchOS 26.3 – Fixed memory handling issue.
- tvOS 26.3 – Addressed vulnerability in file processing.
- macOS Tahoe 26.3 – Improved memory management to prevent exploitation.
- macOS Sonoma 14.8.4 – Resolved denial-of-service risk.
- macOS Sequoia 15.7.4 – Enhanced security against crafted files.
- iOS 18.7.5 – Mitigated potential memory disclosure.
- iPadOS 18.7.5 – Fixed vulnerability in file handling.
- visionOS 26.3 – Addressed memory handling issues.
- iOS 26.3 – Improved security against crafted files.
- iPadOS 26.3 – Resolved memory handling vulnerabilities.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Regularly applying security updates and being cautious about opening files from untrusted sources can help reduce the risk of exploitation.