Paper/Archive/CVE-2026-20688

CVE-2026-20688

Apple iOS and iPadOS — A path handling issue was addressed with improved validation.

CVSS 9.3 (ADP)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 21.1.211 × 204.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to break out of its sandbox.

Affected

ProductAffectedFixed inSource

iOS and iPadOS< 26.426.4CNA

macOS< 14.8.514.8.5CNA

macOS< 15.7.515.7.5CNA

macOS< 26.426.4CNA

visionOS< 26.426.4CNA

Scores by source

CISA ADP9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.apple.com/en-us/126792 refsupport.apple.com/en-us/126794 refsupport.apple.com/en-us/126795 refsupport.apple.com/en-us/126796 refsupport.apple.com/en-us/126799