CVE-2026-20635 Apple CVE debrief

Who should care

Organizations and individuals using Apple Safari and other affected products should be aware of this vulnerability and take necessary steps to mitigate it. This includes updating to the latest versions of the affected products. Additionally, users should be cautious when processing web content from untrusted sources.

Technical summary

The vulnerability is caused by a memory handling issue in Apple Safari and other products. Processing maliciously crafted web content can lead to an unexpected process crash. The issue was addressed with improved memory handling in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.

Defensive priority

Medium priority should be given to patching this vulnerability, as it could lead to a denial-of-service attack. Organizations should prioritize patching based on their specific risk assessment and asset management.

Recommended defensive actions

• Update Apple Safari to version 26.3 or later
• Update iOS and iPadOS to version 18.7.5 or later
• Update macOS to version 26.3 or later
• Update tvOS to version 26.3 or later
• Update visionOS to version 26.3 or later
• Update watchOS to version 26.3 or later

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its description, CVSS score, and affected products. Apple has provided release notes and vendor advisories for the affected products.

Official resources