Executive brief
iOS and macOS contain a race condition in CoreServices that allows malicious apps to gain root-level privileges on the device. This gives an attacker complete control over the system, enabling access to all user data, installed apps, and system functions. Exploitation requires the user to install a malicious app, but once installed, the attacker can bypass all security protections.
Technical details
CVE-2026-20617 is a race condition vulnerability in Apple's CoreServices framework affecting iOS, iPadOS, and macOS. The vulnerability stems from improper state handling that allows an app to manipulate system state during a critical timing window to achieve privilege escalation. An attacker must craft a malicious app and convince a user to install it; no network access is required. Successful exploitation grants the app root privileges, enabling full system compromise. The vulnerability has been patched in iOS 26.3, iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3, released on February 11, 2026.
Affected products
- Apple iOS before 26.3
- Apple iPadOS before 26.3
- Apple macOS Sequoia before 15.7.4
- Apple macOS Sonoma before 14.8.4
- Apple macOS Tahoe before 26.3
- Apple tvOS before 26.3
- Apple visionOS before 26.3
- Apple watchOS before 26.3
Timeline
- 2026-02-11: disclosed