iOS CVE-2026-20698

Requires a malicious or compromised app installed on vulnerable iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS devices (versions before 26.4). A low-privilege local app can exploit this without user interaction to corrupt kernel memory or crash the system.

While CVSS and EPSS scores are not publicly available, this vulnerability carries significant real-world risk based on other signals. The technical impact is severe: unexpected system termination represents a clear denial of service vector, while kernel memory corruption could enable privilege escalation or arbitrary code execution within the kernel context. The vulnerability affects Apple's entire ecosystem, from consumer devices (iPhone, iPad, Mac, Apple Watch) to enterprise and specialized devices (Apple TV, Vision Pro), creating a broad attack surface. The fact that Apple issued coordinated patches across all six major operating system families simultaneously indicates high severity internally. The attack vector likely requires user interaction (installing a malicious app) and medium complexity (crafting exploit code), but the barrier to exploitation is reasonable for motivated threat actors. The lack of disclosed CVSS/EPSS data suggests either: (1) the vulnerability was discovered internally and patched before external disclosure, or (2) exploit details are being withheld during coordinated disclosure. Real-world priority is HIGH: kernel memory corruption vulnerabilities are typically exploited in advanced persistent threat campaigns and privilege escalation chains.

A malicious actor creates a seemingly benign app and distributes it via the App Store or alternative channels, exploiting gaps in review processes. When the app executes on a target device, it triggers the memory handling vulnerability in the kernel, causing either immediate system termination (denial of service) or persistent kernel memory corruption that can be leveraged in multi-stage attacks to escalate privileges or achieve kernel-level code execution. The attack requires no special user privileges beyond normal app execution permissions, making it accessible to mass-market adversaries, though successful kernel memory exploitation typically requires specialized reverse engineering skills.