macOS CVE-2026-20651

While the CVSS score and vector are not yet published, the vulnerability is classified as a privacy issue (information disclosure) and has been patched across three major macOS release lines, indicating Apple considers this a material security concern. The attack vector appears to be local (requiring an attacker to run code on the affected system), which raises the barrier to exploitation compared to network-based attacks. The lack of a published CVSS or EPSS score, combined with no confirmation of active exploitation or public POC, suggests this may be a moderate-priority issue for most users. However, the fact that Apple issued patches across three concurrent OS versions (Sequoia, Sonoma, and the newer Tahoe) indicates the issue was widely exploitable and potentially easy to trigger. For users in high-security environments or those running multi-tenant systems where untrusted local applications may execute, this represents a meaningful privacy risk and should be prioritized for patching. The automatable nature of local file system enumeration and the technical impact (unauthorized information disclosure) elevate the real-world priority despite the absence of public exploitation.

An attacker with local system access or who has tricked a user into running a malicious application could enumerate the temporary file directories (typically /tmp, /var/tmp, or application-specific temp locations) to discover and read sensitive files left behind by other applications or system processes. These temporary files might contain authentication tokens, user documents, cryptographic material, or other private data that the attacker's app would normally be unable to access due to user privilege separation. The attacker does not need elevated privileges; ordinary user-level code execution is sufficient to trigger the vulnerability.