CVE-2026-20672: Buffer Overflow
Published Feb 11, 2026
·Updated
Accounts. A parsing issue in the handling of directory paths was addressed with improved path validation.
Other sources
Accounts. An authorization issue was addressed with improved state management.
— Apple
Admin Framework. A parsing issue in the handling of directory paths was addressed with improved path validation.
— Apple
afpfs. A buffer overflow was addressed with improved bounds checking.
— Apple
An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.3. An app may be able to access sensitive user data.
— MITRE
apache. This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
— Apple
Credit
Mickey Jin@@patch1t, jioundai, Amy (amys.website), @@cloudlldb, Kirin@@Pwnrin(Fudan University), LFY@@secsys(Fudan University), Anonymous(Trend Micro Zero Day Initiative), Yiğit Can YILMAZ@@yilmazcanyigit, Golden Helm Securities(Iru), Gergely Kalman@@gergely_kalman(Iru), Csaba Fitzl@@theevilbit(Iru), Gergely Kalman@@gergely_kalman, an anonymous researcher, Google Threat Analysis Group, Kirin@@Pwnrin, Asaf Cohen, Murray Mike, George Karchemsky@@gkarchemsky(Trend Micro Zero Day Initiative), Jian Lee@@speedyfriend433, Keisuke Hosoda, Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef, CVE-2025-59375, Ron Masas(BreakPoint), Chunyu Song(NorthSea), Rodolphe Brunetti@@eisw0lf(Lupus Nova), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Noah Gregory (wts.dev), Pwn2car, Enis Maholli (enismaholli.com), CVE-2026-20622, Morris Richman@@morrisinlife, Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir, Gongyu Ma@@Mezone0, LeminLimez, Nathaniel Oh@@calysteon, HanQing(TSDubhe), Nan Wang@@eternalsakura13, Tom Van Goethem, EntryHi, Wang Yu(Cyberserval), Ryan Dowd@@_rdowd, Johnny Franks (zeroxjf), Adam Franke(CyStack), Trung Nguyen@@everping(CyStack), Ashish Kunwar, 이재영(Appknox), Vinay Kumar Rasala (Xplo8E)(Appknox), Stuart Wallace, Arni Hardarson (Neonix Security), Dave G., Bartlomiej Dmitruk(striga), Stanislaw Strzalkowski(isec), Narendra Singh@@_3P1C, Peter Malone, Rahul Raj, Pinak Oza, Robert Mindo, Vladislav Shevchenko (Positive Technologies), tamdao, Franco Belman at Blackwing Intelligence, Peter Malone(cyberplanet), Nicolas Rabrenovic(cyberplanet), Irvin Wang(cyberplanet), Rishabh Jain (rjcyber)(cyberplanet), impost0r (ret2plt), David Ige - Beryllium Security, lokerxx(Economics), Narendra Singh@@_3P1C(Economics), Lyutoon(Economics), Jordy Zomer@@pwningsystems(Economics), Richard Zana(Economics), George Stergiopoulos(Economics), InfoSec lab(Economics), Athens University(Economics), Business, Greece, Aswin Kumar Gokulakannan, 이재영, Pavan Nallamothu, Jared Reyes, John Lussier, Seonung Park, ALTV!ST (altvi.st/), Dun, YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), Richard Zana, Daniel Williams, Anonymous(TrendAI Zero Day Initiative), ret2happy, Mathis Mansière, James Duffy@@0x4A616D657344, stratan@@5tratan, Matthew Schneider, Dallas Dubs(Nosebeard Labs), Aaron Grattafiori - NVIDIA AI Red Team(Nosebeard Labs), XBreach.ai(Nosebeard Labs), Yongyue WANG AKA Brian.W(OKX security), Roman Zabicki(Nosebeard Labs), Katika Mohaseen(Nosebeard Labs), an anonymous researcher(Nosebeard Labs), CVE-2026-3784, CVE-2026-3783, CVE-2025-14017, CVE-2025-14819, HvxyZLF, Lance Cain - Offensive Security Engineer, SpecterOps Inc., Jonathan Bar Or@@yo_yo_yo_jbo, Anthony Laou Hine Tsuei@@anarcheuz, Gil Portnoy & Henry, Ayaan Ahmad, Hyunwoo Kim@@v4bel, erdene-och Byambabayar, Niels Hofmans, Manuel Fernandez (Stackhopper Security), Stanislav Jelezoglo(Positive Technologies), Ilya Andr (andrd3v)(Positive Technologies), Redon Gashi, Nicolas Rabrenovic, Atul R V & Ashmit Sharma, Hcamael, 章鱼哥 （aipyaipy.com）@@aipy, Surya Narayan Kushwaha, Cem Onat Karagun, Alfredo Pesoli@@__rev(Bynar), Tristan Madani@@TristanInSec(Talence Security), Jonathan Alush-Aben, Arni Hardarson, Michael DePlante@@izobashi(TrendAI Zero Day Initiative), Gandalf4a(PKU), Anton Pakhunov, PETOWORKS의 Bugeun Choi@@Bugeun, Geonha Lee@@leegn4a, Dhiyanesh Selvaraj@@redroot97, hxr1(STAR Labs SG Pte), Hiroki Imai (LAC Co.(STAR Labs SG Pte), Ltd.)(STAR Labs SG Pte), Billy Jheng Bing Jhong(STAR Labs SG Pte), Pan Zhenpeng@@Peterpan0927(STAR Labs SG Pte), Igor Ushakov, Ryan Hileman via Xint Code (xint.io), Adam Doupé(ASU SEFCOM), Ashish Kunwar(MurphySec), f0r(MurphySec), Mahmoud Abdelmoniem(ThreatBook), Feng Xue(ThreatBook), XGPT(ThreatBook), Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), Fábio Luís@@scanpt, DARKNAVY@@DarkNavyOrg, Gor Aleksanyan, Michal Kosiorek, Eddy Tsalolikhin, Asjid Kalam@@odinshell, Hyunwoo Kim@@v4bel(ThreatBook), Wang Yu(STAR Labs SG Pte), Ernesto Martínez García, Calif Research, Ji'an Zhou, Mingxuan Yang, Ye Zhang, Ye Zhang@@VAR10CK(Baidu Security), Vladislav Shevchenko (Positive Technologies)(STAR Labs SG Pte), Pasquale Scola(STAR Labs SG Pte), Lukas Gerlach, Ruslan Dautov, CVE-2026-4424, Prathamesh Walunj@@attahasa, Atul R V, Daisuke Hatakeyama Research)@@SYZD, Richard Zana(Nosebeard Labs), wh0am1i, Robert Tran, Dan Raviv, Koh M. Nakagawa@@tsunek0h(FFRI Security Inc), Matej Moravec@@MacejkoMoravec, 九宫格(Chongqing Telecom), Chanwit Muenprakoddee (ChemIndy), Aethel-Systems, Narcis Oliveras Fontàs, Sindre Sorhus, Francisco Knabe, Zachary Neal(Stripe), Hcamael(Stripe), 章鱼哥 (aipyaipy.com)@@aipy(Stripe), JC Alvarado(Stripe), Jacob Hazak, @@pixiepointsec, Nik Tsytsarkin, Junming C.(Chapoly1305), He Wei (ギカク)(Cisco Talos), Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Kitten Food, Calif.io in collaboration with Claude, Anthropic Research, Tien-Chih Lin(CyCraft Technology), Bruce Dang(Calif), Aaron Grattafiori - NVIDIA AI Red Team, Pyrophoria, Estifanos Megersa, Ahmed Uddin, yk lin@@pixiepointsec, silo, wdszzml(Bynar), Atuin Automated Vulnerability Discovery Engine(Bynar)
Affected Software
5 affected componentsFixes available
Apple macOS Sequoia<15.7.8
15.7.8
Apple macOS Sonoma<14.8.8
14.8.8
Apple macOS>=14.0<14.8.8
Apple macOS>=15.0<15.7.8
Apple macOS Tahoe<26.3
26.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.7.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.8.8
Event History
Feb 11, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Description
Updated
via Apple·12:00 AM
DescriptionWeakness
Jul 27, 2026
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionAffected Software
CVE Published
via MITRE·08:14 PM
Data Sourced
via MITRE·08:14 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-20669
- CVE-2026-20670
- CVE-2026-20637
- CVE-2026-20625
- CVE-2026-20624
- CVE-2026-20650
- CVE-2026-20660
- CVE-2026-20639
- CVE-2026-20681
- CVE-2026-20611
- CVE-2026-20609
- CVE-2026-20617
- CVE-2026-20615
- CVE-2026-20627
- CVE-2025-14174
- CVE-2025-43529
- CVE-2026-20700
- CVE-2026-20668
- CVE-2026-20629
- CVE-2026-20601
- CVE-2026-20623
- CVE-2026-20649
- CVE-2026-20620
- CVE-2026-20675
- CVE-2026-20634
- CVE-2026-20654
- CVE-2026-20626
- CVE-2026-20671
- CVE-2026-20630
- CVE-2026-20672
- CVE-2025-59375
- CVE-2026-20667
- CVE-2026-20673
- CVE-2026-20677
- CVE-2026-20651
- CVE-2026-20694
- CVE-2026-20616
- CVE-2026-20603
- CVE-2026-20666
- CVE-2026-20614
- CVE-2026-20656
- CVE-2026-20628
- CVE-2026-28855
- CVE-2026-20658
- CVE-2026-20610
- CVE-2026-20653
- CVE-2026-20622
- CVE-2026-20648
- CVE-2026-20662
- CVE-2026-20647
- CVE-2026-20680
- CVE-2026-20612
- CVE-2026-20699
- CVE-2026-20641
- CVE-2026-20619
- CVE-2026-20618
- CVE-2026-20606
- CVE-2026-20605
- CVE-2026-20646
- CVE-2026-20652
- CVE-2026-20608
- CVE-2026-20676
- CVE-2026-20644
- CVE-2026-20636
- CVE-2026-20635
- CVE-2026-20621
- CVE-2026-20602
- CVE-2026-43749
- CVE-2026-65404
- CVE-2026-64767
- CVE-2026-43815
- CVE-2026-23918
- CVE-2026-64695
- CVE-2026-43801
- CVE-2026-43781
- CVE-2026-64737
- CVE-2026-43748
- CVE-2026-43776
- CVE-2026-43681
- CVE-2026-43761
- CVE-2026-43672
- CVE-2026-43763
- CVE-2026-64702
- CVE-2026-64725
- CVE-2026-64747
- CVE-2026-64762
- CVE-2026-64707
- CVE-2026-28849
- CVE-2026-64698
- CVE-2026-64734
- CVE-2026-43756
- CVE-2026-43693
- CVE-2026-43673
- CVE-2026-43744
- CVE-2026-43803
- CVE-2026-43775
- CVE-2026-43711
- CVE-2026-28936
- CVE-2026-43738
- CVE-2026-84489
- CVE-2026-43802
- CVE-2026-64710
- CVE-2026-39875
- CVE-2026-64701
- CVE-2026-43698
- CVE-2026-3784
- CVE-2026-3783
- CVE-2025-14017
- CVE-2025-14819
- CVE-2026-43758
- CVE-2026-64708
- CVE-2026-28926
- CVE-2026-43747
- CVE-2026-64694
- CVE-2026-28945
- CVE-2026-64776
- CVE-2026-43793
- CVE-2026-43753
- CVE-2026-43714
- CVE-2026-64740
- CVE-2026-43796
- CVE-2026-64692
- CVE-2026-43682
- CVE-2026-28981
- CVE-2026-43773
- CVE-2026-43767
- CVE-2026-64697
- CVE-2026-43764
- CVE-2026-43710
- CVE-2025-43325
- CVE-2026-64716
- CVE-2026-43780
- CVE-2026-43818
- CVE-2026-43661
- CVE-2026-64754
- CVE-2026-64693
- CVE-2026-64714
- CVE-2026-43805
- CVE-2026-39877
- CVE-2026-64749
- CVE-2026-43782
- CVE-2026-64744
- CVE-2026-64775
- CVE-2026-28982
- CVE-2026-43778
- CVE-2026-64735
- CVE-2026-43822
- CVE-2026-64700
- CVE-2026-43799
- CVE-2026-43810
- CVE-2026-43724
- CVE-2026-43722
- CVE-2026-43809
- CVE-2026-43757
- CVE-2026-43769
- CVE-2026-43754
- CVE-2026-64723
- CVE-2026-39868
- CVE-2026-64709
- CVE-2026-64721
- CVE-2026-64717
- CVE-2026-28983
- CVE-2026-4424
- CVE-2026-28900
- CVE-2026-28973
- CVE-2026-64739
- CVE-2026-43703
- CVE-2026-43706
- CVE-2026-43766
- CVE-2026-64738
- CVE-2026-43653
- CVE-2026-64724
- CVE-2026-43723
- CVE-2026-43807
- CVE-2026-43733
- CVE-2026-43729
- CVE-2026-64772
- CVE-2026-64774
- CVE-2026-64770
- CVE-2026-64769
- CVE-2026-64722
- CVE-2026-64768
- CVE-2026-64771
- CVE-2026-43771
- CVE-2026-43772
- CVE-2026-28961
- CVE-2026-64711
- CVE-2026-28912
- CVE-2026-43765
- CVE-2026-28896
- CVE-2026-28933
- CVE-2026-64731
- CVE-2026-43812
- CVE-2026-43694
- CVE-2026-39874
- CVE-2026-64764
- CVE-2026-64763
- CVE-2026-64766
- CVE-2026-64765
- CVE-2026-43779
- CVE-2026-43777
- CVE-2026-43665
- CVE-2026-64745
- CVE-2026-39873
- CVE-2026-64696
- CVE-2026-64704
- CVE-2026-43774
- CVE-2026-43770
- CVE-2026-43768
- CVE-2026-64703
- CVE-2026-64699
- CVE-2026-43750
- CVE-2026-28932
- CVE-2026-28914
- CVE-2026-28836
- CVE-2026-28911
- CVE-2026-86902
- CVE-2026-43760
- CVE-2026-43755
Frequently Asked Questions
1
What is the severity of CVE-2026-20672?
The severity of CVE-2026-20672 is medium with a CVSS score of 5.5.
2
How do I fix CVE-2026-20672?
To fix CVE-2026-20672, update to macOS Sequoia 15.7.8 or later versions.
3
What is the impact of CVE-2026-20672?
CVE-2026-20672 can lead to information disclosure and potential buffer overflow vulnerabilities.
4
Which software is affected by CVE-2026-20672?
CVE-2026-20672 affects Apple macOS Sequoia and Apple macOS Sonoma.
5
What types of vulnerabilities are associated with CVE-2026-20672?
CVE-2026-20672 is associated with buffer overflow, input validation issues, and information leak vulnerabilities.