CVE-2026-20687: use-after-free in Apple OS

CVE-2026-20687 is a use-after-free vulnerability officially reported to NVD on March 25, 2026. The flaw allows an app to cause unexpected system termination and, more critically, to write directly into kernel memory. The CVE affects iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS and watchOS. Apple released patches on March 25, 2026.

The CVSS score of 7.1 (high severity) reflects real risk: a local app can cause denial-of-service and, more critically, modify kernel memory, potentially escalate privileges or access protected data. No in-the-wild exploitation has been reported according to NVD data. However, active research signals (GitHub, October 30, 2026) indicate interest in exploitation via kernel access, specifically linked to Apple driver components. This is a re-emergence driven by technical research activity, not public exploit release.

Administrators of Apple infrastructure must prioritize inventory of iOS, iPadOS, macOS, tvOS and watchOS devices managed in-house, identify those still on versions prior to the patches (iOS 18.7.7, macOS Sequoia 15.7.5, etc.) and schedule upgrade to these versions or later within short timeframe. Although the patch has been available for months, today's research activity justifies review of patch status. For environments where immediate update is not possible, restricting installation of apps from external or unverified sources is advisable until patching is complete.