CVE-2026-20675
Published: 11 February 2026
Summary
CVE-2026-20675 is a medium-severity Command Injection (CWE-77) vulnerability in Apple Macos. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-20675 is a vulnerability in Apple's operating systems addressed through improved bounds checks, associated with CWE-77 and CWE-125. It affects image processing in iOS prior to 18.7.5 and 26.3, iPadOS prior to 18.7.5 and 26.3, macOS Sequoia prior to 15.7.4, macOS Sonoma prior to 14.8.4, macOS Tahoe prior to 26.3, tvOS prior to 26.3, visionOS prior to 26.3, and watchOS prior to 26.3. Processing a maliciously crafted image may lead to disclosure of user information, with a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
The attack requires local access, low complexity, no privileges, and user interaction. A local attacker can trick a user into processing a malicious image, achieving high-impact disclosure of user information without integrity or availability effects and without scope changes.
Apple security advisories at https://support.apple.com/en-us/126346, https://support.apple.com/en-us/126347, https://support.apple.com/en-us/126348, https://support.apple.com/en-us/126349, and https://support.apple.com/en-us/126350 detail the fixes via improved bounds checks in the specified versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6193
Vulnerability details
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. Processing a…
more
maliciously crafted image may lead to disclosure of user information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables local info disclosure via malicious image file requiring user interaction to open/process.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of image input to enforce bounds checking and reject malformed data that would otherwise trigger the out-of-bounds read.
Mandates timely application of the vendor patches that implement the improved bounds checks described in the CVE fix.
Provides memory-access protections that can block or contain the information disclosure resulting from the out-of-bounds read during image processing.