iOS CVE-2026-20687

Local access required. Victim must interact with a malicious app on iOS 18.7.6 or earlier, iPadOS 18.7.6 or earlier, macOS Sequoia 15.7.4 or earlier, macOS Tahoe 26.3 or earlier, tvOS 26.3 or earlier, or watchOS 26.3 or earlier. User interaction triggers the use-after-free vulnerability in kernel memory management.

While the CVSS score and vector are not provided in the intelligence data, the vulnerability presents significant real-world risk based on multiple factors. The attack vector is 'local' (an app must be present on the device), and the technical impact includes both system termination and kernel memory write capabilities, indicating high severity. The fact that this affects five major Apple operating systems suggests broad exposure across millions of devices. The tagging as 'Denial of Service' aligns with the confirmed system termination impact, though the kernel memory write capability could enable privilege escalation or sandbox escape scenarios not fully explored in the public description. No EPSS score or KEV status is provided, but the coordinated release of six support articles across product lines indicates this was a planned, managed disclosure rather than a zero-day. The absence of a disclosed POC and the deliberate nature of Apple's patching suggest this is not being actively exploited in the wild at time of disclosure. The primary risk is to users on unpatched systems who run untrusted applications, making this a 'patch on schedule' priority rather than an emergency response scenario.

An attacker crafts a malicious application that exploits the use-after-free condition in the kernel's memory allocator by triggering a specific sequence of system calls that cause the kernel to free a memory region prematurely, then reallocates that region for attacker-controlled data structures. When the kernel continues to operate on the freed memory expecting its original structure, the attacker can either corrupt kernel state causing an immediate crash (DoS) or write specific values to kernel memory to escalate privileges or disable security features. This requires only that the malicious app be installed on the device (via App Store compromise, sideloading, or enterprise distribution), with no additional user interaction needed beyond the initial installation.