CVE-2026-20700: Apple Multiple Operating Systems Buffer Overflow

CVE-2026-20700 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-02-12

A security vulnerability exists in the operating systems for Apple iPhones, iPads, Macs, and other devices that could allow a malicious actor to take control of the device. If exploited, an attacker could execute unauthorized commands, potentially leading to the theft of personal data or full system compromise. Apple has reported that this flaw has been used in highly targeted attacks against specific individuals.

Technologies: Apple iPadOS, Apple macOS, Apple Multiple Products, Apple Tvos, Apple Visionos, Apple watchOS. Vendors: Apple.

Quick answers

Is CVE-2026-20700 exploited in the wild?
Yes. CVE-2026-20700 is known to be exploited in the wild, first recorded on 12 February 2026. Treat it as urgent.
How severe is CVE-2026-20700?
Critical severity, with a CVSS score of 7.8, published 12 February 2026.
Which products and versions are affected?
Apple iPadOS before 26.3; Apple macOS before 26.3; Apple Tvos before 26.3; Apple Visionos before 26.3; and 1 more.
Is there a fix for CVE-2026-20700?
A patch was published on 2026-02-12: Fixes released in version 26.3 for all platforms Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20700 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-20700?
Check whether you run Apple iPadOS, Apple macOS, Apple Multiple Products or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability (CWE-119) exists across multiple Apple operating systems due to improper state management. An attacker who already possesses local memory write capabilities can exploit this flaw to achieve arbitrary code execution. The vulnerability has been observed in the wild being used in sophisticated, targeted attacks. Apple addressed the issue by improving state management in the affected components. Patches are available in version 26.3 across all impacted platforms.

Affected products

  • Apple iOS before 26.3
  • Apple iPadOS before 26.3
  • Apple macOS Tahoe before 26.3
  • Apple tvOS before 26.3
  • Apple visionOS before 26.3
  • Apple watchOS before 26.3

Timeline

  • 2026-02-11: disclosed: Initial disclosure by Apple
  • 2026-02-12: advisory: NVD and CISA publication
  • 2026-02-12: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2026-02-12: exploited: Confirmed exploitation in the wild against targeted individuals
  • 2026-02-12: patched: Fixes released in version 26.3 for all platforms

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.