CVE-2026-20605: macOS and iOS DoS Vulnerability

CVE-2026-20605 Overview

CVE-2026-20605 is a memory handling vulnerability affecting multiple Apple operating systems including macOS and iOS/iPadOS. The vulnerability stems from improper memory handling (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) that allows a malicious application to crash a system process. This denial of service condition requires physical access to the target device for exploitation.

Critical Impact

A locally installed malicious application can exploit improper memory handling to crash system processes, potentially disrupting device functionality and user operations.

Affected Products

• macOS Sequoia versions prior to 15.7.4
• iOS 18.7.5 and iPadOS 18.7.5 and earlier versions
• macOS Tahoe versions prior to 26.3
• macOS Sonoma versions prior to 14.8.4

Discovery Timeline

• 2026-02-11 - CVE-2026-20605 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-20605

Vulnerability Analysis

This vulnerability exists due to improper memory handling within Apple's operating system components. The flaw is classified under CWE-119, which encompasses vulnerabilities where software performs operations on a memory buffer without properly restricting those operations to the intended boundaries. When a malicious application triggers this condition, it can cause a system process to crash, resulting in denial of service.

The attack requires physical access to the device, meaning an attacker must have direct access to install or run a malicious application on the target system. While this limits remote exploitation potential, it remains a concern for shared device environments, kiosk deployments, and scenarios where attackers can gain temporary physical access.

Root Cause

The root cause is improper memory handling within system-level components of Apple's operating systems. The vulnerability falls under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating that memory operations were not properly constrained, allowing out-of-bounds access or other memory corruption scenarios that destabilize system processes.

Attack Vector

Exploitation requires physical access to the target device. An attacker would need to install or execute a malicious application on the vulnerable system. The malicious app can then trigger the memory handling flaw to crash a system process. While the vulnerability does not enable privilege escalation or code execution based on available information, the ability to crash system processes can disrupt normal device operation and potentially be chained with other vulnerabilities in more sophisticated attacks.

The attack complexity is low, requires no privileges, and no user interaction beyond running the malicious application. The impact is limited to availability—the vulnerability does not compromise confidentiality or integrity of system data.

Detection Methods for CVE-2026-20605

Indicators of Compromise

• Unexpected system process crashes or restarts on affected Apple devices
• Applications exhibiting abnormal memory access patterns
• System logs showing process terminations related to memory handling errors
• Presence of unfamiliar or suspicious applications on the device

Detection Strategies

• Monitor system logs for recurring system process crashes that may indicate exploitation attempts
• Implement application allowlisting to prevent unauthorized applications from running
• Use endpoint detection solutions to identify malicious applications attempting memory manipulation
• Review installed applications for unauthorized or suspicious software

Monitoring Recommendations

• Enable verbose logging for system processes on affected Apple devices
• Configure alerts for repeated system process failures
• Monitor for applications attempting to allocate unusual amounts of memory
• Implement regular system integrity checks to detect unauthorized application installations

How to Mitigate CVE-2026-20605

Immediate Actions Required

• Update all affected Apple devices to the patched versions immediately
• Review installed applications and remove any unauthorized or suspicious software
• Restrict physical access to devices in shared or public environments
• Enable automatic security updates on all Apple devices

Patch Information

Apple has released security updates to address this vulnerability. Apply the following updates based on your platform:

• macOS Sequoia: Update to version 15.7.4 or later - See Apple Support Advisory #126347
• iOS/iPadOS: Update to version 18.7.5 or later - See Apple Support Advisory #126348
• macOS Tahoe: Update to version 26.3 or later - See Apple Support Advisory #126349
• macOS Sonoma: Update to version 14.8.4 or later - See Apple Support Advisory #126350

Workarounds

• Limit physical access to devices to trusted personnel only
• Implement strict application installation policies using MDM solutions
• Enable Gatekeeper on macOS to prevent unsigned applications from running
• Use supervised mode on iOS devices to control application installations

# Check current macOS version
sw_vers

# Enable automatic security updates on macOS
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool true

# Verify Gatekeeper is enabled
spctl --status