What is the CVSS score of CVE-2026-20611?

CVE-2026-20611 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by CVE-2026-20611?

CVE-2026-20611 is a high-severity out-of-bounds access vulnerability affecting Apple's ecosystem across iOS, macOS, tvOS, iPad, and visionOS platforms.

How to fix or mitigate CVE-2026-20611?

Within 24 hours: Inventory all Apple devices across the organization and identify those running affected OS versions (iOS/iPadOS below 18.7.5, macOS Sonoma below 14.8.4, macOS Sequoia below 15.7.4, and other affected platforms). Within 7 days: Develop and communicate a phased patching schedule prioritizing high-risk endpoints (executive devices, healthcare systems, critical infrastructure access points). Within 30 days: Complete patch deployment across 100% of affected systems and validate successful updates through device management tools.

Apple CVE-2026-20611

HIGH

Out-of-bounds Read (CWE-125)

2026-02-11 product-security@apple.com

Apple Buffer Overflow Information Disclosure

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

AnalysisAI

Memory corruption in Apple's media processing across iOS, macOS, watchOS, tvOS, and visionOS allows local attackers to crash applications or corrupt process memory by supplying specially crafted media files. An attacker with local access and user interaction can trigger out-of-bounds memory access during media file parsing, potentially leading to arbitrary code execution or denial of service. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-125 (Out-of-bounds Read). Affects Ipados. An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.