Product:
macOS, iOS, iPadOS, visionOS
Summary
A race condition was addressed with improved handling of symbolic links. This issue allows a shortcut to potentially bypass sandbox restrictions. The vulnerability affects multiple Apple operating systems, including macOS Tahoe, macOS Sonoma, iOS, and iPadOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9 | CVE-2026-20677 |
Exploitation
To exploit this vulnerability, an attacker could create a malicious shortcut that takes advantage of the race condition in symbolic link handling. By doing so, the attacker may be able to bypass the sandbox restrictions that are typically in place to protect user data and system integrity. This could lead to unauthorized access to sensitive information or system resources.
Affected Products
- macOS Tahoe: Affected by the race condition allowing sandbox bypass.
- macOS Sonoma: Vulnerable to the same issue as Tahoe.
- iOS: Includes the vulnerability affecting device security.
- iPadOS: Similar vulnerabilities as iOS, impacting iPad security.
- visionOS: Also affected by the race condition.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of macOS, iOS, iPadOS, and visionOS as soon as possible. Apple has released patches that address the race condition and improve the handling of symbolic links, which should be applied to ensure system security.