CVE-2026-20605: 
macOS vulnerability analysis and mitigation

CVE-2026-20605 is a memory handling vulnerability in Apple's Voice Control component that allows an app to crash a system process, resulting in a denial-of-service condition. It affects iOS and iPadOS before 18.7.5, macOS Sonoma before 14.8.4, macOS Sequoia before 15.7.4, and macOS Tahoe before 26.3. The vulnerability was disclosed and patched on February 11, 2026. It carries a CVSS v3.1 base score of 4.6 (Medium), reflecting a physical attack vector with no privileges required (Apple iOS Advisory, Apple macOS Tahoe Advisory, Feedly).

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a memory buffer mismanagement issue within the Voice Control subsystem. Apple addressed the flaw with improved memory handling, suggesting the root cause involved unsafe memory operations that could be triggered by a malicious application. The attack vector is physical (CVSS AV:P), meaning an attacker would need local access to the device or the ability to run a malicious app on it to trigger the crash of a system process. The vulnerability was discovered and reported by @cloudlldb of @pixiepointsec (Apple iOS Advisory, Apple macOS Sequoia Advisory).

Successful exploitation allows a malicious application to crash a system process, resulting in a denial-of-service condition that disrupts system stability and availability. There is no impact on confidentiality or integrity, as the vulnerability is limited to availability (CVSS C:N/I:N/A:H). The scope is unchanged, meaning the impact is confined to the affected system without potential for lateral movement or data exfiltration (Apple macOS Sonoma Advisory, Feedly).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to iOS 18.7.5 or iPadOS 18.7.5, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, or macOS Tahoe 26.3 or later. No configuration-based workarounds have been published; updating to a patched version is the recommended and only known remediation (Apple iOS Advisory, Apple macOS Tahoe Advisory, Apple macOS Sonoma Advisory).