CVE-2026-20700

Name of the Vulnerable Software and Affected Versions iOS versions prior to 19.4.1 iOS versions prior to 18.7.5 iPadOS versions prior to 19.4.1 iPadOS versions prior to 18.7.5 macOS Sequoia versions prior to 15.7.4 visionOS versions prior to 2.4.1 tvOS (affected versions not specified) watchOS (affected versions not specified)

Description A heap-based memory corruption exists in the dyld (Dynamic Link Editor) component, which is responsible for loading and linking applications and libraries. The issue stems from improper validation of the bind info metadata within a loaded binary, where an invalid offset for a symbol binding can cause a buffer overflow. This allows an attacker to overwrite critical function pointers within the dyld process and execute arbitrary code with system privileges. The flaw can be triggered via malformed Mach-O binaries or malicious web content and message previews, enabling zero-click remote code execution. This issue has been exploited in highly targeted attacks against high-value individuals.

Recommendations Update iOS to version 19.4.1 or 18.7.5. Update iPadOS to version 19.4.1 or 18.7.5. Update macOS Sequoia to version 15.7.4. Update visionOS to version 2.4.1. Enable Lockdown Mode in Settings > Privacy & Security to restrict complex web content and message previews. Reset network settings after patching to clear potential persistent DNS hijacks.