CVE-2026-20700

What it actually does

This is a memory-corruption vulnerability caused by improper state management. An attacker who already has a foothold with the ability to perform memory writes can corrupt process or kernel memory in a way that may redirect execution flow and run arbitrary code. Successful exploitation can compromise confidentiality, integrity, and availability by allowing code execution in the security context of the vulnerable component. Apple reports the issue was fixed in iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3; supplied package metadata also indicates Debian 11 linux packages are fixed in version 5.10.178-1.

Why it matters to the business

The main risk is targeted device or endpoint compromise, including spyware-style access, credential theft, surveillance, persistence, and further lateral movement from a compromised device. The vulnerability is in the CISA Known Exploited Vulnerabilities catalog, has reported active exploitation in highly targeted attacks, and has a CISA remediation due date of 2026-03-05, so organizations subject to KEV requirements should treat remediation as mandatory and time-bound. Although the EPSS score is relatively low, confirmed in-the-wild exploitation and the high impact of arbitrary code execution make this a priority for managed Apple fleets and any listed downstream Linux package exposure.

How an attack unfolds

An attacker first obtains an initial position that gives them the ability to influence or write memory in the vulnerable component, often through a chained exploit, malicious content delivery path, or another local compromise. They then trigger the flawed state-management condition so memory is corrupted in a controlled way. If exploitation succeeds, execution flow is redirected to attacker-controlled code or a payload already staged in memory. In reported real-world activity, Apple stated the issue may have been used in extremely sophisticated attacks against specific targeted individuals on versions of iOS before iOS 26; the provided threat context references DarkSword and an Apple multiple-buffer-overflow vulnerability campaign label. After code execution, an attacker would typically collect sensitive data, install persistence where possible, evade detection, and use the compromised device as a platform for surveillance or additional access.

How to fix it

Apply vendor fixes as the primary remediation. Upgrade Apple devices to iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3 or later as applicable. For the supplied Debian package metadata, update Debian 11 linux packages to 5.10.178-1 or later. Because this issue is KEV-listed and actively exploited, prioritize internet-exposed, executive, administrator, developer, legal, diplomatic, journalist, and other high-risk user devices. Where immediate patching is not possible, reduce exposure by enforcing device management controls, restricting untrusted content and profiles, limiting sideloading or unapproved applications, disabling unnecessary services, and increasing monitoring for crash, persistence, and post-exploitation indicators. Mitigations should be considered temporary; patching is required for risk reduction.

How to confirm the fix worked

Confirm remediation by inventorying operating system and package versions. Apple endpoints should report iOS/iPadOS/macOS/tvOS/visionOS/watchOS version 26.3 or later where applicable. Debian 11 systems should show the linux package version at 5.10.178-1 or later. Validate through MDM, endpoint management, package manager output, vulnerability scanner authenticated checks, and vendor advisory mapping. For Apple fleets, verify that devices have successfully rebooted after update installation and are not deferred, pending, or stuck in a failed update state. For Linux package validation, confirm the running kernel matches the updated installed kernel after reboot, not merely that the package is present on disk.

Typical attack path

1. Identify a device or system running an affected version, especially iOS versions before iOS 26 or other unpatched Apple platforms listed as affected by the vendor advisory.
2. Gain an initial foothold or exploit chain primitive that provides local execution or memory-write capability.
3. Trigger the vulnerable state-management path to corrupt memory.
4. Use the memory corruption to obtain arbitrary code execution in the context of the vulnerable process or component.
5. Deploy an in-memory payload or follow-on tooling for data access, surveillance, persistence, or privilege escalation.
6. Clean up transient artifacts, suppress crashes where possible, and continue operating against selected high-value targets.

How to detect it

To determine whether exploitation may already have occurred, collect and review endpoint, MDM, EDR, crash, and system telemetry from affected devices for the period before patching. On Apple platforms, examine crash reports, panic logs, analytics logs, unified logs, configuration profile changes, unusual app installs, unexpected background execution, abnormal network connections, and signs of persistence or surveillance tooling. Prioritize devices running iOS before iOS 26 or other Apple platforms below 26.3, especially high-risk users. Look for repeated memory-access crashes in the same system component, unexplained process restarts, kernel panics, unsigned or unexpected binaries, unusual launch agents or daemons on macOS, suspicious configuration profiles, and outbound connections to uncommon infrastructure shortly before or after crashes. On Debian 11 systems, review kernel logs, audit logs, authentication logs, EDR process telemetry, and package update history for abnormal crashes, privilege escalation, unexpected root processes, kernel warnings, or suspicious activity before the fixed 5.10.178-1 kernel was installed and booted. There are no public exploit-specific network signatures or file hashes provided in the advisory, so detection should focus on crash patterns, exploit-chain behavior, and post-exploitation artifacts rather than a single definitive IOC.

• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• SIGSEGV
• panic-full
• JetsamEvent
• /Library/Logs/DiagnosticReports/
• /Library/Logs/CrashReporter/
• /Library/LaunchAgents/
• /Library/LaunchDaemons/
• ~/Library/LaunchAgents/
• /var/log/syslog
• /var/log/kern.log
• /var/log/auth.log
• kernel: BUG:
• kernel: general protection fault
• kernel: unable to handle kernel paging request

What your security team should do

• Treat this as a priority remediation item because it is KEV-listed, actively exploited, and associated with highly targeted attacks.
• Patch affected Apple platforms to 26.3 or later and Debian 11 linux packages to 5.10.178-1 or later; ensure systems are rebooted where required.
• Prioritize high-risk users and devices, including executives, administrators, developers, incident responders, public-facing personnel, and users likely to be targeted by spyware or nation-state activity.
• Use MDM and endpoint inventory to identify devices running iOS versions before iOS 26 and any Apple platform below the fixed 26.3 release line.
• Review recent device crash logs, panic logs, EDR telemetry, MDM compliance events, and authentication activity for signs of exploitation or suspicious post-compromise behavior.
• If suspicious activity is found on a high-risk mobile device, preserve forensic evidence before wiping or reimaging and consider specialized mobile threat analysis.
• Monitor for threat intelligence updates related to DarkSword, Apple memory-corruption exploit chains, and related vulnerabilities CVE-2025-14174 and CVE-2025-43529.
• Document KEV remediation status and complete required remediation before the 2026-03-05 due date where applicable.