CVE-2026-20602: 
macOS vulnerability analysis and mitigation

CVE-2026-20602 is a denial-of-service vulnerability in the WindowServer component of Apple macOS, caused by improper handling of caches. It affects macOS Sonoma versions before 14.8.4, macOS Sequoia versions before 15.7.4, and macOS Tahoe versions before 26.3. The vulnerability was disclosed and patched on February 11, 2026, with the advisory published by Apple. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with no user interaction required (Apple Sequoia Advisory, Apple Sonoma Advisory, Apple Tahoe Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and resides in the WindowServer component, which manages display and windowing services on macOS. The root cause is improper handling of caches within WindowServer, which can be abused by a locally installed application to exhaust system resources and trigger a denial-of-service condition. Exploitation requires only low privileges and no user interaction, making it accessible to any app running on the affected system. The vulnerability was discovered and reported by @cloudlldb of @pixiepointsec (Apple Sequoia Advisory, Apple Sonoma Advisory, Apple Tahoe Advisory).

Successful exploitation allows a malicious local application to cause a denial-of-service condition, potentially crashing or rendering the WindowServer process unresponsive, which would disrupt the graphical user interface and all dependent applications on the affected macOS system. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Given that WindowServer is a critical system process, its disruption could effectively lock out interactive users from the desktop environment (Apple Sequoia Advisory, Apple Sonoma Advisory).

Apple has addressed this vulnerability in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.3, all released on February 11, 2026. Users should update their macOS installations to these versions or later via System Settings > Software Update. No configuration-based workarounds have been published by Apple; upgrading to a patched version is the recommended and only known remediation (Apple Sequoia Advisory, Apple Sonoma Advisory, Apple Tahoe Advisory).