CVE-2026-20646

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to read sensitive location information.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/126348	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:17

Type	Values Removed	Values Added
Summary		(es) Un problema de registro fue abordado con una ocultación de datos mejorada. Este problema está solucionado en macOS Tahoe 26.3. Una aplicación maliciosa podría leer información de ubicación sensible.

13 Feb 2026, 20:17

Type	Values Removed	Values Added
CWE		CWE-532

13 Feb 2026, 14:47

Type	Values Removed	Values Added
CPE		cpe:2.3:o:apple:macos::::::::
References	~~() https://support.apple.com/en-us/126348 -~~	() https://support.apple.com/en-us/126348 - Release Notes, Vendor Advisory
First Time		Apple macos Apple
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 3.3

11 Feb 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-11 23:16

Updated : 2026-06-17 10:17

NVD link : CVE-2026-20646

Mitre link : CVE-2026-20646

CVE.ORG link : CVE-2026-20646

JSON object : View

Products Affected

apple

macos

CWE

NVD-CWE-noinfo CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-20646", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20646", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-13T19:43:04.977854Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0", "lessThan": "26.3", "versionType": "custom"}]}]}], "published": "2026-02-11T23:16:07.530", "references": [{"url": "https://support.apple.com/en-us/126348", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to read sensitive location information."}, {"lang": "es", "value": "Un problema de registro fue abordado con una ocultaci\u00f3n de datos mejorada. Este problema est\u00e1 solucionado en macOS Tahoe 26.3. Una aplicaci\u00f3n maliciosa podr\u00eda leer informaci\u00f3n de ubicaci\u00f3n sensible."}], "lastModified": "2026-06-17T10:17:36.407", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1EEEE88-5ADA-4C55-9C7C-397E904408DD", "versionEndExcluding": "26.3"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}