What is the CVSS score of CVE-2026-20687?

CVE-2026-20687 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-20687?

CVE-2026-20687 is a high-severity use-after-free vulnerability affecting Apple's operating systems (iOS, iPadOS, macOS, tvOS, watchOS) that allows locally installed applications to corrupt kernel…. A patch is available.

How to fix or mitigate CVE-2026-20687?

Within 24 hours: Inventory all organizational Apple devices (iOS, iPadOS, macOS, tvOS, watchOS) and their current OS versions; alert users not to install untrusted applications. Within 7 days: Monitor Apple security advisories for vendor-released patches and prepare deployment procedures. Within 30 days: Deploy available patches to all affected Apple devices as released by Apple; prioritize macOS and iOS endpoints handling sensitive data or critical functions.

macOS CVE-2026-20687

EUVD-2026-15058 HIGH

Use After Free (CWE-416)

2026-03-25 apple

GHSA-c4px-j3mf-78gh

Apple Use After Free Memory Corruption Denial Of Service macOS iOS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:16 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,15.7.5,18.7.7

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15058

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:35 nvd

HIGH 7.1

DescriptionCVE.org

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, watchOS 26.4. An app may be able to cause unexpected system termination or write kernel memory.

AnalysisAI

Apple's iOS, iPadOS, macOS, tvOS, and watchOS contain a use-after-free vulnerability that could allow a local attacker to corrupt kernel memory or cause unexpected system crashes. An installed application can trigger this memory corruption flaw through user interaction, potentially leading to denial of service or unauthorized kernel-level modifications. No patch is currently available for this vulnerability (CVSS 7.1).

Technical ContextAI

This vulnerability is a use-after-free (CWE-416 class) issue in memory management within Apple's kernel subsystem, affecting the core operating system across all major Apple platforms as indicated by the CPE strings (cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:watchos). Use-after-free vulnerabilities occur when a program continues to access memory regions after they have been freed, allowing attackers to either cause memory corruption leading to system crashes or, in sophisticated attacks, to write arbitrary data to freed memory regions now under attacker control. The fact that this affects kernel memory distinguishes it from user-space vulnerabilities and elevates its severity, as kernel memory corruption can compromise system stability and security guarantees. Apple's remediation involved improved memory management practices, likely through better reference counting, use of safer memory patterns, or additional bounds checking in the affected code paths.

RemediationAI

Immediately upgrade to iOS 18.7.7 or iPadOS 18.7.7, iOS 26.4 or iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, or watchOS 26.4, depending on your device (see Apple support articles at the references above). Enable automatic OS updates in device settings to ensure timely patching of future kernel vulnerabilities. Until patching is complete, restrict the installation of untrusted third-party applications by enforcing App Store-only installation policies through Mobile Device Management (MDM) on managed devices, and educate users to avoid sideloading or installing applications from unknown sources. Organizations should prioritize patching tvOS and watchOS devices first if they are used in security-sensitive environments, as these platforms may receive less frequent manual update attention from users.