Apple has released emergency updates for iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS to fix a zero-day vulnerability exploited in targeted, sophisticated attacks.
🔎 The flaw
- CVE-2026-20700 (CVSS 7.8)
- Memory corruption in dyld (Dynamic Link Editor)
- Could allow arbitrary code execution on vulnerable devices
- Discovered and reported by Google Threat Analysis Group (TAG)
Apple confirmed the issue may have been used in highly targeted attacks against specific individuals on earlier iOS 26 versions.
🧠 Related vulnerabilities
Apple also referenced two previously patched flaws:
- CVE-2025-14174 – Out-of-bounds memory access in ANGLE’s Metal renderer
- CVE-2025-43529 – Use-after-free in WebKit enabling code execution via malicious web content
Both were addressed in late 2025 but linked to the broader exploitation report.
📦 Affected & Updated Platforms
Updates now available for:
- iOS 26.3 / iPadOS 26.3 (iPhone 11+ and supported iPads)
- macOS Tahoe 26.3
- tvOS 26.3
- watchOS 26.3
- visionOS 26.3
- Legacy updates for iOS 18.7.5, macOS Sequoia & Sonoma, and Safari 26.3
⚠️ Why this matters
This marks Apple’s first actively exploited zero-day of 2026, following nine zero-days patched in 2025.
Even highly controlled ecosystems are not immune to advanced, targeted exploitation.
🧩 Executive takeaway
Organizations managing Apple fleets should prioritize rapid patch deployment — particularly for high-risk or executive users — as memory corruption vulnerabilities remain a preferred vector in targeted campaigns.
