What is the CVSS score of CVE-2026-20690?

CVE-2026-20690 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-20690?

Organizations using An out-of-bounds access should be aware of notable risk from CVE-2026-20690, a out-of-bounds read vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-20690?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS CVE-2026-20690

EUVD-2026-15060 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-25 apple

Buffer Overflow Information Disclosure Apple iOS macOS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,26.4,18.7.7

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15060

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 6.5

DescriptionCVE.org

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing an audio stream in a maliciously crafted media file may terminate the process.

AnalysisAI

Maliciously crafted media files containing out-of-bounds memory access in Apple's audio processing can crash affected applications across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker can trigger a denial of service by triggering the vulnerability through a specially crafted audio stream, though no patch is currently available. This impacts multiple recent OS versions where an out-of-bounds read occurs during media file processing.

Technical ContextAI

This vulnerability resides in Apple's media processing framework, specifically in the audio stream parsing and decoding components that handle various audio formats within media containers. The issue is classified as an out-of-bounds access flaw, which occurs when the audio processing code attempts to read or write memory beyond the allocated buffer boundaries without proper validation of the input stream's structure and size. The affected CPE ranges include cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos, indicating the vulnerability exists across Apple's entire ecosystem. The root cause relates to improper input validation and insufficient bounds checking when parsing audio stream headers or data segments, allowing an attacker-controlled media file to trigger memory access violations without proper size validation.

RemediationAI

Immediately upgrade all affected Apple devices to the patched versions: iOS and iPadOS to 18.7.7 or 26.4, macOS Sequoia to 15.7.5, macOS Sonoma to 14.8.5, macOS Tahoe to 26.4, and tvOS, visionOS, and watchOS to version 26.4. Organizations should prioritize patching systems that regularly process media files from untrusted sources, such as mail servers, web browsers, and media streaming applications. For users unable to immediately patch, restrict access to untrusted media files and disable automatic media preview features in applications that process audio streams. Consult Apple's official security advisories at https://support.apple.com/en-us/126792 through https://support.apple.com/en-us/126799 for platform-specific patching procedures and to verify successful update installation.