What is the CVSS score of CVE-2026-20698?

CVE-2026-20698 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-20698?

CVE-2026-20698 is a high-severity memory handling flaw affecting Apple's entire operating system ecosystem (iOS, iPadOS, macOS, tvOS, visionOS, and watchOS) that allows malicious applications to…. A patch is available.

How to fix or mitigate CVE-2026-20698?

Within 24 hours: Inventory all Apple devices across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS deployments and identify those running versions prior to 26.4. Within 7 days: Establish a phased update schedule prioritizing business-critical systems and user-facing devices; deploy version 26.4 or later across all Apple platforms. Within 30 days: Complete full organizational deployment across all Apple devices; validate patch deployment through device management tools and confirm version compliance.

macOS CVE-2026-20698

EUVD-2026-15073 HIGH

Out-of-bounds Write (CWE-787)

2026-03-25 apple

GHSA-fc7w-w2c7-j46c

Apple Memory Corruption Buffer Overflow macOS iOS

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:17 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15073

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

HIGH 7.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to cause unexpected system termination or corrupt kernel memory.

AnalysisAI

This vulnerability is a memory handling flaw in Apple's operating systems (iOS, iPadOS, macOS, tvOS, visionOS, and watchOS) that allows a malicious application to trigger unexpected system termination or corrupt kernel memory. The vulnerability affects all versions prior to the version 26.4 releases across Apple's entire ecosystem. An attacker can exploit this by crafting a malicious app that triggers improper memory handling, potentially leading to denial of service or privilege escalation through kernel memory corruption.

Technical ContextAI

The vulnerability stems from inadequate memory handling in Apple's kernel or core system libraries shared across iOS/iPadOS (cpe:2.3:a:apple:ios_and_ipados), macOS (cpe:2.3:a:apple:macos), tvOS (cpe:2.3:a:apple:tvos), visionOS (cpe:2.3:a:apple:visionos), and watchOS (cpe:2.3:a:apple:watchos). The root cause appears to be related to memory management within application-to-kernel interaction layers, though the specific CWE classification is not publicly disclosed. The vulnerability permits user-space applications to access or manipulate kernel memory regions that should be protected, indicating a boundary enforcement weakness. This is a classic memory safety issue affecting multiple Apple platforms simultaneously, suggesting a shared architectural vulnerability in how these operating systems validate and restrict memory access from user-level processes.

RemediationAI

Immediately upgrade to the patched versions: iOS 26.4 and iPadOS 26.4 for mobile devices, macOS Tahoe 26.4 for Mac computers, tvOS 26.4 for Apple TV, visionOS 26.4 for Vision Pro, and watchOS 26.4 for Apple Watch. Users should enable automatic updates where possible or manually check Settings > General > Software Update (iOS/iPadOS), System Settings > General > Software Update (macOS), or equivalent paths on other platforms. Enterprise users should coordinate patch deployment through mobile device management (MDM) solutions to ensure swift coverage across device fleets. Until patching is completed, restrict untrusted app installations by maintaining curated App Store allowlists, disabling sideloading where possible, and reviewing app permissions. Monitor system logs for unexpected terminations or kernel panics that might indicate exploitation attempts. Refer to Apple's official security updates at the links provided above for detailed patch notes and compatibility information.