macOS CVE-2026-20632

The real-world risk is moderate to significant despite missing formal CVSS and EPSS metrics. The vulnerability is classified as information disclosure with a local attack vector, suggesting an attacker requires either application execution on the target system or user interaction. The absence of published EPSS scores and KEV designation suggests either nascent disclosure or limited observed exploitation in the wild at the time of analysis. However, several risk factors elevate concern: (1) the vulnerability affects the macOS operating system itself, giving it broad applicability across all macOS Tahoe users, (2) the attack surface includes user-level applications that may be compromised or malicious, and (3) no workarounds are documented, making patching the only mitigation. The unavailability of CVSS vector details prevents precise assessment of attack complexity and privilege requirements, but path validation bugs are typically straightforward to exploit once discovered. Organizations should prioritize this patch for high-value endpoints and those running untrusted software.

A malicious or compromised third-party application could exploit this path validation flaw to access sensitive user data stored in protected directories such as ~/Library/Preferences, ~/Library/Cookies, or ~/Library/Caches without user knowledge or sandbox restrictions. For example, a photo editing app could craft specially-formatted directory path strings that bypass validation checks and enumerate or exfiltrate user photos, contacts, or browsing history from privileged locations. The local attack vector and apparent ease of manipulation through path construction (typical of validation bypasses) suggest exploitation requires only the ability to execute code on the system, a risk heightened in environments where users install software from untrusted sources.