What is the CVSS score of CVE-2026-20679?

CVE-2026-20679 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-20679?

Yes, a patch is available for CVE-2026-20679. Update the affected software to the latest version immediately.

Apple macOS CVE-2026-20679

EUVD-2026-63776 MEDIUM

Out-of-bounds Read (CWE-125)

2026-08-21 apple

GHSA-p6hg-hpqv-cp2w

Information Disclosure Buffer Overflow Apple

4.3

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

File delivered remotely but requires user interaction; impact is application crash only, with no confirmed confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 21, 2026 - 20:26 vuln.today

Patch available

Aug 21, 2026 - 01:01 EUVD

CVE Published

Aug 21, 2026 - 00:38 cve.org

MEDIUM 4.3

CVE Published

Aug 21, 2026 - 00:38 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously crafted file may lead to unexpected app termination.

AnalysisAI

Unexpected application termination in Apple macOS arises when processing a maliciously crafted file, triggering an out-of-bounds read (CWE-125) that crashes the handling application. Affected versions span all three active macOS release trains: Sonoma prior to 14.8.5, Sequoia prior to 15.7.5, and Tahoe prior to 26.4. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that a user on an unpatched macOS system actively opens or processes a maliciously crafted file - user interaction is mandatory (UI:R in CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk for this CVE is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary remediation is to apply the vendor-released patches: upgrade to macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, or macOS Tahoe 26.4, available via System Settings > Software Update. … Detailed patch versions, workarounds, and compensating controls in full report.