Product:
iOS, iPadOS, macOS Sequoia, macOS Sonoma, macOS Tahoe
Summary
This issue was addressed with improved handling of symlinks. An app may be able to access user-sensitive data. The issue is fixed in multiple versions of iOS, iPadOS, and macOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-20694 |
Exploitation
To exploit this vulnerability, an attacker would need to have local access to the device. By manipulating symlinks, the attacker could potentially gain unauthorized access to sensitive user data. This could be achieved through malicious applications that leverage the symlink handling flaw.
Affected Products
- iOS 26.3 and later: Addresses symlink handling issues that could expose user data.
- iPadOS 26.3 and later: Similar fixes for symlink vulnerabilities affecting user data access.
- macOS Sequoia 15.7.4 and 15.7.5: Improved symlink handling to protect user-sensitive information.
- macOS Sonoma 14.8.4 and 14.8.5: Fixes for vulnerabilities related to symlink handling.
- macOS Tahoe 26.3 and 26.4: Addresses the same symlink handling issues.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of iOS, iPadOS, and macOS as soon as possible. Regularly applying software updates will help protect against potential exploits that leverage this issue.