CVE-2026-20616

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. Processing a maliciously crafted USD file may lead to unexpected app termination.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Apple	iOS and iPadOS	< 18.7.5
Apple	macOS	< 14.8.4; < 26.3
Apple	visionOS	< 26.3

References

https://support.apple.com/en-us/126347Release Notes, Vendor Advisory
https://support.apple.com/en-us/126348Release Notes, Vendor Advisory
https://support.apple.com/en-us/126350Release Notes, Vendor Advisory
https://support.apple.com/en-us/126353Release Notes, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-26-176/

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-206177.0A race condition was addressed with improved state handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS So CVE-2026-206185.5An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user CVE-2026-206195.5A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be abl CVE-2026-20627.5A vulnerability was identified in Open5GS up to 2.7.6. This affects the function sgwc_s5c_handle_modify_bearer_response/sgwc_sxa_handle_sess CVE-2026-206207.7An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, CVE-2026-206215.5The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS CVE-2026-206227.5A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, m CVE-2026-206235.5A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may CVE-2026-206245.5An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.CVE-2026-206255.5A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.4,CVE-2026-206267.8This issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Tahoe 26.3, visi CVE-2026-206275.5An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.