CVE-2026-20625

What the vulnerability is

CVE-2026-20625 is a parsing issue in the handling of directory paths across multiple Apple operating systems. The root cause is insufficient path validation, which could allow an application to bypass directory restrictions and access sensitive user data. The vulnerability was fixed with improved path validation [1].

Exploitation prerequisites

Exploitation requires that a malicious or compromised application be installed on the device. The attacker must have the capability to run code at the app level, but no additional privileges are specified. The attack surface is local, meaning an app already on the system can exploit the flaw to access data it should not be able to reach.

Impact

An attacker exploiting this vulnerability could read sensitive user data that would normally be protected by directory permissions [1][2]. The impact is limited to confidentiality, with no indication of data modification or system compromise. The severity is rated Medium (CVSS 5.5).

Mitigation

Apple has released patches for affected versions: macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, and visionOS 26.3 [1][2][3][4]. Users should update their devices to the latest available version. No workarounds are documented; updating is the recommended action.