CVE-2026-20621

Vulnerability

Overview

CVE-2026-2026-20621 is a memory handling issue in Apple's memory handling that could allow an app to cause unexpected system termination or corrupt kernel memory. The vulnerability was addressed with improved memory handling in multiple Apple operating systems.

Attack

Vector and Prerequisites

The vulnerability requires an app to be running on the affected device. No additional privileges or user interaction beyond installing the app are mentioned in the description. The attack surface is local, as the app must be executed on the device.

Impact

Successful exploitation could lead to unexpected system termination (denial of service) or corruption of kernel memory, which could potentially leading to arbitrary code execution at the kernel level. The CVSS v3 score of 5.5 (Medium) reflects the need for local access and the potential for high impact on availability and integrity.

Mitigation

Apple has released patches for this issue in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, and visionOS 26.3 [1][2][3][4]. Users should update their devices to the latest available versions.