CVE-2026-20700

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20700 7.8

Apple · Multiple Products · Added 2026-02-12 · Published 2026-02-11

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityApple Multiple Buffer Overflow Vulnerability

VendorApple

ProductMultiple Products

Date added2026-02-12

Due date2026-03-05

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-119

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.

NVD: A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-30 18:43 UTC

Wall time30s

Searches2

Component defaultyes

Sources https://support.apple.com/en-us/126346
https://nvd.nist.gov/vuln/detail/cve-2026-20700
https://github.com/R3n3r0/CVE-2026-20700
https://github.com/R3n3r0/CVE-2026-20700/blob/master/README.md
https://securityaffairs.com/187890/security/apple-fixed-first-actively-exploited-zero-day-in-2026.html
https://thehackernews.com/2026/02/apple-fixes-exploited-zero-day.html
https://www.securityweek.com/apple-patches-ios-zero-day-exploited-in-extremely-sophisticated-attack/
https://feedly.com/cve/CVE-2026-20700

Hunting hypothesis agent

Hunt iOS/macOS crash logs for dyld4::fixupPage64 KERN_PROTECTION_FAILURE at __DATA when dlopen loads a dylib with ~99k bind targets; chain_close PoC writes a PAC-signed dispatch_source_t timer at __DATA+0x20 invoked via event loop

Research details

Componentdyld (Dynamic Link Editor) page-in linking and chained fixup machinery

PreconditionsPrior memory write capability (low-privileged local access) on the target device, typically achieved through an initial exploit chain (e.g., WebKit RCE via crafted web content) providing a memory write primitive; Target must run a vulnerable version of Apple operating systems (iOS/iPadOS/tvOS/watchOS/visionOS before 26.3, macOS Tahoe before 26.3); The exploit requires delivering a hand-crafted Mach-O dylib file with malformed chained-fixup entries that abuse dyld's page-in linking gate to produce PAC-valid pointers into attacker-chosen memory slots; Tested on iPhone 14 (iOS 18.5, arm64e); CVE-2025-14174 and CVE-2025-43529 address the same exploit chain agent

DeliveryLocal code execution via chained Mach-O loading: attacker exploits a memory write primitive (typically from a prior WebKit RCE via CVE-2025-43529) to load a hand-crafted libmalformed.dylib containing LC_DYLD_CHAINED_FIXUPS with malformed page_start and next values. dyld's page-in linking gate is entered when libclient.dylib provides ~99k bind targets (below the 100k threshold). In chain_close mode, dyld writes a PAC-signed dispatch_source_t timer handler at __DATA+0x20, which fires naturally through the process event loop after 1 second—no direct invocation from the PoC code.

Public PoCyes

PoC URLs https://github.com/R3n3r0/CVE-2026-20700 Third-party repos; verify before use.

Advisoryhttps://support.apple.com/en-us/126346

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.8) — exploitation requires a prior memory write primitive (e.g., WebKit RCE via CVE-2025-43529), then a crafted Mach-O dylib triggers dyld to write PAC-valid pointers. The PoC (R3n3r0/CVE-2026-20700) demonstrates three modes: (1) stress — deterministic crash in fixupPage64 with page_start=0x3FF8, next=0x80 producing KERN_PROTECTION_FAILURE at 0xBFF8; (2) exploit — stable intra-image write at __DATA+0x10 via page_start=0x10; (3) chain_close — PAC-signed pointer at __DATA+0x20 registered as dispatch_source_t timer, called naturally through the event loop. Tested on iPhone 14 (iOS 18.5, arm64e). The 99k bind target count (below 100k gate threshold) is configurable via SYMBOLS make variable. Code signing requires an Apple-trusted certificate for the dylib, and the sandbox restricts dlopen paths from WebContent. Discovery by Google Threat Analysis Group.

SummaryCVE-2026-20700 is a memory corruption vulnerability in Apple's dyld (Dynamic Link Editor), the core system component responsible for loading dynamic libraries and linking application code across all Apple operating systems. Discovered and reported by Google Threat Analysis Group (TAG), this zero-day was exploited in extremely sophisticated targeted attacks against specific individuals on iOS versions prior to iOS 26. The vulnerability stems from improper state management in dyld's handling of memory buffers during dynamic library loading, specifically within the page-in linking and chained fixup machinery on arm64e architectures. An attacker who first achieves a memory write primitive (typically through an initial exploit chain such as WebKit RCE via crafted web content) can leverage this dyld flaw to escalate privileges and execute arbitrary code with elevated permissions. The fix was released on February 11, 2026 across all Apple platforms: iOS 26.3/iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3. A public proof-of-concept (dyld-signing-oracle-poc by R3n3r0) demonstrates how dyld's own chained-fixup mechanism can be abused as a PAC signing oracle, writing attacker-controlled PAC-valid pointers into chosen memory slots. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with a LOCAL attack vector and LOW attack complexity. Apple also issued CVE-2025-14174 and CVE-2025-43529 in response to the same report, indicating multiple related issues were uncovered during the investigation. The vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on February 12, 2026, with a remediation due date of March 5, 2026.

Tia coverage

First reported2026-09-28

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

apple-patches-coregraphics-out-of-bounds-write-cve-2026-86950

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.