CVE-2026-20700

7.8

HIGH CVSS 3.1

Apple Multiple Buffer Overflow Vulnerability - [Actively Exploited]

Description

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.

INFO

Published Date :

Feb. 11, 2026, 11:16 p.m.

Last Modified :

Feb. 13, 2026, 2:03 p.m.

Remotely Exploit :

No

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 05, 2026

Alert Date: Feb 12, 2026 | 20 days ago

Description :

Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://support.apple.com/en-us/126346 ; https://support.apple.com/en-us/126348 ; https://support.apple.com/en-us/126351 ; https://support.apple.com/en-us/126352 ; https://support.apple.com/en-us/126353 ; https://nvd.nist.gov/vuln/detail/CVE-2026-20700

Affected Products

The following products are affected by CVE-2026-20700 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Apple	macos
2	Apple	iphone_os
3	Apple	tvos
4	Apple	watchos
5	Apple	ipados
6	Apple	visionos

: Total Affected Vendor : 1 | Products : 6

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				134c704f-9b21-4f2e-91b3-4a467353bcc0

Solution

Update all affected Apple devices to the latest available software version.

Update watchOS to version 26.3.
Update tvOS to version 26.3.
Update macOS to version 26.3.
Update iOS and iPadOS to version 26.3.

Public PoC/Exploit Available at Github

CVE-2026-20700 has a 8 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-20700.

URL	Resource
https://support.apple.com/en-us/126346	Release Notes Vendor Advisory
https://support.apple.com/en-us/126348	Release Notes Vendor Advisory
https://support.apple.com/en-us/126351	Release Notes Vendor Advisory
https://support.apple.com/en-us/126352	Release Notes Vendor Advisory
https://support.apple.com/en-us/126353	Release Notes Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20700	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-20700 is associated with the following CWEs:

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-20700 weaknesses.

CAPEC-8: Buffer Overflow in an API Call Buffer Overflow in an API Call CAPEC-9: Buffer Overflow in Local Command-Line Utilities Buffer Overflow in Local Command-Line Utilities CAPEC-10: Buffer Overflow via Environment Variables Buffer Overflow via Environment Variables CAPEC-14: Client-side Injection-induced Buffer Overflow Client-side Injection-induced Buffer Overflow CAPEC-24: Filter Failure through Buffer Overflow Filter Failure through Buffer Overflow CAPEC-42: MIME Conversion MIME Conversion CAPEC-44: Overflow Binary Resource File Overflow Binary Resource File CAPEC-45: Buffer Overflow via Symbolic Links Buffer Overflow via Symbolic Links CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion CAPEC-100: Overflow Buffers Overflow Buffers CAPEC-123: Buffer Manipulation Buffer Manipulation

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

utkarshpilgrim/macOS-Patch-Engineering-Lab

None

Python

Updated: 1 week, 3 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 22, 2026, 8:47 a.m. This repo has been linked 1 different CVEs too.

JGoyd/ZombieHunter

None

Python

Updated: 4 days, 5 hours ago

1 stars 1 fork 1 watcher

Born at : Feb. 20, 2026, 11:40 p.m. This repo has been linked 1 different CVEs too.

KFaeKay/KfaeKay

Technical research and forensic documentation of shadow management, persistent OS overlays, and hidden drive exploits

Updated: 1 week, 6 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 19, 2026, 5:02 a.m. This repo has been linked 1 different CVEs too.

sundenovak/CVE-2026-20700-An-analysis-WIP

[WORK IN PROGRESS] My analysis of CVE-2026-20700

Updated: 1 week, 2 days ago

2 stars 0 fork 0 watcher

Born at : Feb. 18, 2026, 12:27 p.m. This repo has been linked 3 different CVEs too.

bytehazard/CVE-2026-20700

None

Updated: 2 weeks ago

1 stars 0 fork 0 watcher

Born at : Feb. 16, 2026, 10:52 p.m. This repo has been linked 1 different CVEs too.

Idkwhatt0d0/bootstrap18

A Semi-jailbreak for iOS 18.0 -18.7.3/26.1>

Updated: 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Feb. 16, 2026, 11:10 a.m. This repo has been linked 2 different CVEs too.

kimblehardwoods/CVE-2026-20700

None

Updated: 2 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 14, 2026, 6:47 p.m. This repo has been linked 1 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 18 hours, 49 minutes ago

7549 stars 1241 fork 1241 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 754 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-20700 vulnerability anywhere in the article.

Daily CyberSecurity

Bypassing the Bouncer: Apache Tomcat Patches SNI & Legacy Protocol Flaws

The Apache Software Foundation has rolled out a trio of security updates for its ubiquitous Apache Tomcat web server environment, addressing vulnerabilities that range from legacy protocol confusion t ...

Published Date: Feb 20, 2026 (1 week, 5 days ago)

Daily CyberSecurity

The Dev Environment Trap: 128 Million Users at Risk as Top VS Code Extensions Unmask Critical Flaws

Ubiquitous extensions for Visual Studio Code, boasting a cumulative download count exceeding 128 million, have been unmasked as susceptible to exploits involving local file exfiltration and remote cod ...

Published Date: Feb 20, 2026 (1 week, 5 days ago)

Daily CyberSecurity

PoC Publicly Disclosed: Critical Grandstream VoIP Flaw (CVSS 9.3) Grants Stealthy Root Access

If your office desks are equipped with Grandstream GXP1600 series phones, you might want to pause the hold music and update your firmware immediately. A severe zero-day vulnerability has been uncovere ...

Published Date: Feb 20, 2026 (1 week, 5 days ago)

Daily CyberSecurity

CVE-2025-65717: Critical Vulnerability in VS Code’s Live Server Extension Puts 72 Million Developers at Risk, No Patch

Attack Flow | Image: OX Security A wildly popular tool designed to make web development easier is currently harboring a massive security blind spot. Researchers at OX Security have unearthed a severe ...

Published Date: Feb 20, 2026 (1 week, 5 days ago)

Daily CyberSecurity

CI/CD at Risk: High-Severity Jenkins XSS Flaw Exposes Build Environments

Maintainers of Jenkins, the world’s leading open-source automation server, have issued critical security updates to address two vulnerabilities within its core architecture. The advisory highlights a ...

Published Date: Feb 19, 2026 (1 week, 6 days ago)

Daily CyberSecurity

Urgent Chrome Patch: Google Fixes High-Severity PDF and V8 Engine Flaws

Google has initiated an urgent rollout for the Chrome Stable channel, delivering a crucial update to patch three newly disclosed security vulnerabilities. The update, which brings Chrome to version 14 ...

Published Date: Feb 19, 2026 (1 week, 6 days ago)

Daily CyberSecurity

Critical Honeywell CCTV Flaw (CVSS 9.8) Allows Unauthenticated Takeover

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a critical vulnerability in Honeywell CCTV products. The flaw, tracked as CVE-2026-1670, carries a near-maxim ...