CVE-2026-20688

critical · 9.3

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to break out of its sandbox.

9.3

CVSS

0.3%

EPSS (exploit prob.)

20th

EPSS percentile

2026-03-25

Published

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
apple	ipados	< 26.4
apple	iphone_os	< 26.4
apple	macos	>= 14.0, < 14.8.5
apple	macos	>= 15.0, < 15.7.5
apple	macos	>= 26.0, < 26.4
apple	visionos	< 26.4

Check a specific version with /api/v1/cve/match.

References

https://support.apple.com/en-us/126792
https://support.apple.com/en-us/126794
https://support.apple.com/en-us/126795
https://support.apple.com/en-us/126796
https://support.apple.com/en-us/126799

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-20688