Product:
watchOS, tvOS, macOS, iOS, iPadOS, visionOS
Summary
The issue was addressed with improved bounds checks. Processing a maliciously crafted image may lead to disclosure of user information. This vulnerability affects multiple Apple operating systems and requires user interaction to exploit.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-20675 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious image and convince the user to open it on a vulnerable device. The attack requires local access to the device and user interaction, making it less likely to be exploited remotely. Once the image is processed, it may lead to the disclosure of sensitive user information.
Affected Products
- watchOS 26.3: Affected by the vulnerability allowing image processing issues.
- tvOS 26.3: Vulnerable to the same image processing flaw.
- macOS Tahoe 26.3: Contains the vulnerability related to image handling.
- macOS Sonoma 14.8.4: Affected by the image processing issue.
- macOS Sequoia 15.7.4: Vulnerable to the same issue.
- iOS 18.7.5: Contains the vulnerability allowing for potential information disclosure.
- iPadOS 18.7.5: Affected by the image processing vulnerability.
- visionOS 26.3: Vulnerable to the same image processing flaw.
- iOS 26.3: Contains the vulnerability related to image handling.
- iPadOS 26.3: Affected by the image processing issue.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Apple has released updates that address the issue by improving bounds checks. Regularly updating devices can help protect against such vulnerabilities.