CVE-2026-20675
Published: 11 February 2026
Summary
CVE-2026-20675 is a medium-severity Command Injection (CWE-77) vulnerability in Apple Macos. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables local info disclosure via malicious image file requiring user interaction to open/process.
NVD Description
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. Processing a…
more
maliciously crafted image may lead to disclosure of user information.
Deeper analysisAI
CVE-2026-20675 is a vulnerability in Apple's operating systems addressed through improved bounds checks, associated with CWE-77 and CWE-125. It affects image processing in iOS prior to 18.7.5 and 26.3, iPadOS prior to 18.7.5 and 26.3, macOS Sequoia prior to 15.7.4, macOS Sonoma prior to 14.8.4, macOS Tahoe prior to 26.3, tvOS prior to 26.3, visionOS prior to 26.3, and watchOS prior to 26.3. Processing a maliciously crafted image may lead to disclosure of user information, with a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
The attack requires local access, low complexity, no privileges, and user interaction. A local attacker can trick a user into processing a malicious image, achieving high-impact disclosure of user information without integrity or availability effects and without scope changes.
Apple security advisories at https://support.apple.com/en-us/126346, https://support.apple.com/en-us/126347, https://support.apple.com/en-us/126348, https://support.apple.com/en-us/126349, and https://support.apple.com/en-us/126350 detail the fixes via improved bounds checks in the specified versions.
Details
- CWE(s)