CVE-2026-20700

Name of the Vulnerable Software and Affected Versions iOS versions prior to 19.4.1 iOS versions prior to 18.7.5 iPadOS versions prior to 19.4.1 iPadOS versions prior to 18.7.5 macOS versions prior to 15.7.4 macOS versions prior to 26.3 visionOS versions prior to 2.4.1 visionOS versions prior to 26.3 tvOS versions prior to 26.3 watchOS versions prior to 26.3

Description A heap-based memory corruption issue exists in the dyld (dynamic link editor) component, which is responsible for loading and linking applications and libraries. The flaw is caused by improper validation of bind info metadata within a loaded binary, where an invalid offset for a symbol binding can lead to a buffer overflow. This allows an attacker to overwrite critical function pointers within the dyld process, potentially leading to a sandbox escape and remote code execution with system privileges. The issue can be triggered via malformed Mach-O binaries or malicious web content and message previews, potentially requiring zero user interaction. This flaw has been exploited in highly targeted, sophisticated attacks against high-value individuals.

Recommendations Update iOS to version 19.4.1 or 18.7.5. Update iPadOS to version 19.4.1 or 18.7.5. Update macOS to version 15.7.4 or 26.3. Update visionOS to version 2.4.1 or 26.3. Update tvOS to version 26.3. Update watchOS to version 26.3. Enable Lockdown Mode in Settings > Privacy & Security to restrict complex web content and message previews. Reset network settings after patching to clear potential persistent DNS hijacks.