CVE-2026-20653

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20653
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://support.apple.com/en-us/126346 Release Notes Vendor Advisory
https://support.apple.com/en-us/126347 Release Notes Vendor Advisory
https://support.apple.com/en-us/126348 Release Notes Vendor Advisory
https://support.apple.com/en-us/126349 Release Notes Vendor Advisory
https://support.apple.com/en-us/126350 Release Notes Vendor Advisory
https://support.apple.com/en-us/126353 Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
History

13 Feb 2026, 14:46

Type Values Removed Values Added
CPE cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
First Time Apple iphone Os
Apple visionos
Apple ipados
Apple
Apple macos
References () https://support.apple.com/en-us/126346 - () https://support.apple.com/en-us/126346 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/126347 - () https://support.apple.com/en-us/126347 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/126348 - () https://support.apple.com/en-us/126348 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/126349 - () https://support.apple.com/en-us/126349 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/126350 - () https://support.apple.com/en-us/126350 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/126353 - () https://support.apple.com/en-us/126353 - Release Notes, Vendor Advisory

12 Feb 2026, 20:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-22

11 Feb 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-11 23:16

Updated : 2026-02-13 14:46

NVD link : CVE-2026-20653

Mitre link : CVE-2026-20653

CVE.ORG link : CVE-2026-20653

JSON object : View

Products Affected

apple

  • iphone_os
  • ipados
  • visionos
  • macos
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')