CVE-2026-20616

Published: Feb 11, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. Processing a maliciously crafted USD file may lead to unexpected app termination.

Affected (5)

Products: Apple: Ipados, Iphone Os, Macos, Visionos

4 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Before 18.7.5
Apple Iphone Os	Before 18.7.5
Apple Macos	From 14.0 to 14.8.4
Apple Macos	From 26.0 to 26.3
Apple Visionos	Before 26.3

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (5)

https://support.apple.com/en-us/126347

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/126348

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/126350

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/126353

Source: product-security@apple.com

Release NotesVendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-26-176/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.