A race condition was addressed with improved handling of symbolic links. (CVE-2026-20677)
CVE-2026-20677 is a critical race condition vulnerability related to symbolic link handling in Apple operating systems. The flaw could allow a shortcut to bypass sandbox restrictions, potentially leading to full system compromise. The issue affects multiple Apple OS versions and has been addressed in recent updates.
AI Analysis
Technical Summary
This vulnerability involves a race condition in the handling of symbolic links, which could be exploited by a shortcut to bypass sandbox restrictions on affected Apple operating systems. The flaw is identified as CWE-362 (Race Condition) and CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition). It has a CVSS 3.1 base score of 9.0, indicating critical severity with network attack vector, high attack complexity, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. The issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5, iPadOS 18.7.5, visionOS 26.3, iOS 26.3, and iPadOS 26.3.
Potential Impact
Successful exploitation could allow an attacker to bypass sandbox restrictions via a crafted shortcut, potentially leading to full system compromise including unauthorized access to sensitive data, integrity violations, and denial of service.
Mitigation Recommendations
The vulnerability has been fixed in the specified versions of Apple operating systems: macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5, iPadOS 18.7.5, visionOS 26.3, iOS 26.3, and iPadOS 26.3. Users and administrators should apply these updates promptly to mitigate the risk. No additional mitigation steps are indicated beyond applying the official patches.
A race condition was addressed with improved handling of symbolic links. (CVE-2026-20677)
Description
CVE-2026-20677 is a critical race condition vulnerability related to symbolic link handling in Apple operating systems. The flaw could allow a shortcut to bypass sandbox restrictions, potentially leading to full system compromise. The issue affects multiple Apple OS versions and has been addressed in recent updates.
CVSS v3.1
Score 9.0critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a race condition in the handling of symbolic links, which could be exploited by a shortcut to bypass sandbox restrictions on affected Apple operating systems. The flaw is identified as CWE-362 (Race Condition) and CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition). It has a CVSS 3.1 base score of 9.0, indicating critical severity with network attack vector, high attack complexity, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. The issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5, iPadOS 18.7.5, visionOS 26.3, iOS 26.3, and iPadOS 26.3.
Potential Impact
Successful exploitation could allow an attacker to bypass sandbox restrictions via a crafted shortcut, potentially leading to full system compromise including unauthorized access to sensitive data, integrity violations, and denial of service.
Mitigation Recommendations
The vulnerability has been fixed in the specified versions of Apple operating systems: macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5, iPadOS 18.7.5, visionOS 26.3, iOS 26.3, and iPadOS 26.3. Users and administrators should apply these updates promptly to mitigate the risk. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qjq9-mpcc-f8cr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-20677"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a885f31acd9273b493f8476
Added to database: 08/21/2026, 14:22:41 UTC
Last enriched: 08/21/2026, 14:44:09 UTC
Last updated: 09/10/2026, 22:10:17 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.