Product:
watchOS, tvOS, macOS Tahoe, macOS Sonoma, visionOS, iOS, iPadOS
Summary
A race condition was addressed with improved state handling. This issue allows an app to potentially gain root privileges. The issue has been fixed in the latest versions of the affected products.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7 | CVE-2026-20617 |
Exploitation
To exploit this vulnerability, an attacker would need to run a malicious application on a vulnerable device. The race condition can be triggered to gain elevated privileges, allowing the attacker to execute arbitrary code with root access. This could lead to unauthorized access to sensitive data or system functions.
Affected Products
- watchOS 26.3 – Fixed race condition that could allow root access.
- tvOS 26.3 – Addressed vulnerability with improved state handling.
- macOS Tahoe 26.3 – Resolved issue that could lead to privilege escalation.
- macOS Sonoma 14.8.4 – Patched race condition allowing potential root privileges.
- visionOS 26.3 – Updated to fix the vulnerability.
- iOS 26.3 – Addressed the race condition issue.
- iPadOS 26.3 – Fixed vulnerability that could allow apps to gain root access.
Mitigation
Users are advised to update their devices to the latest versions of the affected products to mitigate this vulnerability. Regularly applying security updates can help protect against potential exploits and ensure that devices remain secure.