What is the CVSS score of CVE-2026-20620?

CVE-2026-20620 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by CVE-2026-20620?

CVE-2026-20620 is a high-severity vulnerability affecting multiple macOS versions that could allow attackers to read sensitive data through an out-of-bounds memory access.

How to fix or mitigate CVE-2026-20620?

Within 24 hours: Inventory all macOS systems running Sequoia, Tahoe, or Sonoma versions and assess user populations. Within 7 days: Develop a phased patching plan prioritizing systems with elevated privileges or sensitive data access; communicate patch timeline to stakeholders. Within 30 days: Deploy patches to all affected systems (Sequoia 15.7.4, Tahoe 26.3, Sonoma 14.8.4) and verify successful remediation through compliance scanning.

Apple CVE-2026-20620

HIGH

Out-of-bounds Read (CWE-125)

2026-02-11 product-security@apple.com

Apple Buffer Overflow Information Disclosure

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.7

DescriptionCVE.org

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3, macOS Sonoma 14.8.4. An attacker may be able to cause unexpected system termination or read kernel memory.

AnalysisAI

Local attackers can exploit an out-of-bounds read vulnerability in macOS and Linux systems to crash the kernel or leak sensitive kernel memory, affecting macOS Sequoia 15.7.3 and earlier, macOS Tahoe 26.2 and earlier, and macOS Sonoma 14.8.3 and earlier. The vulnerability requires local access but no special privileges or user interaction to trigger. No patch is currently available for this HIGH severity issue.

Technical ContextAI

Classified as CWE-125 (Out-of-bounds Read). Affects Macos. An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3, macOS Sonoma 14.8.4. An attacker may be able to cause unexpected system termination or read kernel memory.