Cyber Resilience

CVE-2026-20657

Memory Safety in Apple Macos 14.0 – 14.8.5

Published
25 March 2026
Modified
11 May 2026
Patch / advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0054 42th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-20657 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Apple Macos. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. Parsing a maliciously crafted…

more

file may lead to an unexpected app termination.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Buffer overflow triggered by malicious file parsing directly enables client-side exploitation in user applications.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-43740Same product: Apple Ipados
CVE-2026-39872Same product: Apple Ipados
CVE-2026-20644Same product: Apple Ipados
CVE-2026-28940Same product: Apple Ipados
CVE-2026-28905Same product: Apple Ipados
CVE-2026-28941Same product: Apple Ipados
CVE-2023-37285Same product: Apple Ipados
CVE-2023-40416Same product: Apple Ipados
CVE-2023-32410Same product: Apple Ipados
CVE-2025-43186Same product: Apple Ipados

Affected Assets

apple
ipados
≤ 18.7.7
apple
iphone os
≤ 18.7.7
apple
macos
14.0 — 14.8.5 · 15.0 — 15.7.5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-16 Memory Protection
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V17.3.2

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces validation of untrusted file input to block malformed data that triggers buffer overflows during parsing.

prevent

Provides memory safety mechanisms that mitigate out-of-bounds reads/writes (CWE-119/125/787) in the affected parsers.

prevent

Requires timely application of vendor patches that replace the vulnerable memory-handling code in iOS/macOS/visionOS.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (bounds checking, safe APIs, reviews) directly prevent this class of flaw.

ID.RA-01 partial match
prevents

Vulnerability scanning and code analysis directly surface buffer-boundary flaws.

ID.RA-08 partial match
prevents

Receiving and triaging vulnerability disclosures commonly includes buffer-related reports.

PR.AT-02 partial match
prevents

Developer training on secure coding reduces introduction of memory-buffer errors.

PR.PS-02 partial match
prevents

Patching replaces vulnerable code containing buffer-boundary defects.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development catches out-of-bounds accesses before release, covering most instances of the weakness.

A.8.15 Logging partial match
detects

Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.

prevents

Secure development lifecycle mandates memory-safety practices that directly prevent buffer-boundary violations.

prevents

Application security requirements can specify memory-safety rules, but do not prescribe implementation details.

prevents

Secure architecture and engineering principles include memory-safe design patterns that mitigate buffer overflows.

prevents

Secure coding standards explicitly forbid unsafe buffer operations, directly eliminating CWE-119.

References