Cyber Posture

CVE-2026-20675

Medium

Published: 11 February 2026

Published
11 February 2026
Modified
02 April 2026
KEV Added
Patch
CVSS Score 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score 0.0001 2.8th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20675 is a medium-severity Command Injection (CWE-77) vulnerability in Apple Macos. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002).
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Vulnerability enables local info disclosure via malicious image file requiring user interaction to open/process.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. Processing a…

more

maliciously crafted image may lead to disclosure of user information.

Deeper analysisAI

CVE-2026-20675 is a vulnerability in Apple's operating systems addressed through improved bounds checks, associated with CWE-77 and CWE-125. It affects image processing in iOS prior to 18.7.5 and 26.3, iPadOS prior to 18.7.5 and 26.3, macOS Sequoia prior to 15.7.4, macOS Sonoma prior to 14.8.4, macOS Tahoe prior to 26.3, tvOS prior to 26.3, visionOS prior to 26.3, and watchOS prior to 26.3. Processing a maliciously crafted image may lead to disclosure of user information, with a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

The attack requires local access, low complexity, no privileges, and user interaction. A local attacker can trick a user into processing a malicious image, achieving high-impact disclosure of user information without integrity or availability effects and without scope changes.

Apple security advisories at https://support.apple.com/en-us/126346, https://support.apple.com/en-us/126347, https://support.apple.com/en-us/126348, https://support.apple.com/en-us/126349, and https://support.apple.com/en-us/126350 detail the fixes via improved bounds checks in the specified versions.

Details

CWE(s)

Affected Products

apple
ipados
≤ 18.7.5 · 26.0 — 26.3
apple
iphone os
≤ 18.7.5 · 26.0 — 26.3
apple
macos
14.0 — 14.8.4 · 15.0 — 15.7.4 · 26.0 — 26.3
apple
tvos
≤ 26.3
apple
visionos
≤ 26.3
apple
watchos
≤ 26.3

CVEs Like This One

CVE-2026-20611Same product: Apple Ipados
CVE-2025-24243Same product: Apple Ipados
CVE-2024-54499Same product: Apple Ipados
CVE-2024-54525Same product: Apple Ipados
CVE-2025-24230Same product: Apple Ipados
CVE-2026-20650Same product: Apple Ipados
CVE-2026-20641Same product: Apple Ipados
CVE-2024-54523Same product: Apple Ipados
CVE-2025-24129Same product: Apple Ipados
CVE-2025-43209Same product: Apple Ipados

References