Summaryinfo

A vulnerability, which was classified as problematic, has been found in Apple macOS up to 26.3. This affects an unknown function. Performing a manipulation results in an unknown weakness. This vulnerability is cataloged as CVE-2026-20631. The attack must be initiated from a local position. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Apple macOS up to 26.3. The impact remains unknown. The summary by CVE is:

A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. A user may be able to elevate privileges.

It is possible to read the advisory at support.apple.com. This vulnerability is uniquely identified as CVE-2026-20631 since 11/11/2025. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/29/2026).

Upgrading to version 26.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202603-5236). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• macOS

Version

• 26.0
• 26.1
• 26.2
• 26.3

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion