Product:
macOS
Summary
This issue was addressed with improved handling of symlinks. An app may be able to gain root privileges, which poses a significant security risk. The vulnerability has been fixed in macOS Tahoe 26.3.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-20610 |
Exploitation
To exploit this vulnerability, an attacker would need to have local access to the system. By leveraging the improper handling of symlinks, the attacker could potentially escalate privileges to gain root access. This could allow the attacker to execute arbitrary code with elevated permissions, compromising the integrity and confidentiality of the system.
Affected Products
- macOS Tahoe 26.3 – Fixed the symlink handling issue that could allow apps to gain root privileges.
Mitigation
To mitigate this vulnerability, users should update to macOS Tahoe 26.3 or later. Regularly applying security updates and patches is essential to protect against known vulnerabilities. Additionally, users should limit local access to their systems to reduce the risk of exploitation.