CVE-2026-20612: 
macOS vulnerability analysis and mitigation

CVE-2026-20612 is a privacy vulnerability in the Spotlight component of Apple macOS that allows an app to access sensitive user data. It affects macOS Sonoma versions before 14.8.4, macOS Sequoia versions before 15.7.4, and macOS Tahoe versions before 26.3. The vulnerability was disclosed and patched on February 11, 2026, with credit to researcher Mickey Jin (@patch1t). It carries a CVSS v3.1 base score of 5.5 (Medium) (Apple Sequoia Advisory, Apple Sonoma Advisory, Apple Tahoe Advisory).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and stems from insufficient privacy checks within the macOS Spotlight subsystem. Apple's advisory describes it as "a privacy issue addressed with improved checks," indicating that Spotlight failed to properly restrict an application's ability to observe or access sensitive user data. The attack vector is local, requires user interaction, and does not require elevated privileges, meaning a malicious app running in the user's context could exploit this flaw. No public technical write-up or proof-of-concept code has been identified at this time (Apple Sequoia Advisory, Apple Sonoma Advisory, Apple Tahoe Advisory).

Successful exploitation allows a malicious application to access sensitive user data that should be protected by macOS privacy controls within the Spotlight component. The impact is limited to confidentiality — there is no integrity or availability impact. The vulnerability does not enable remote code execution or privilege escalation on its own, but data exposed through Spotlight could include personal files, search history, or other user-sensitive information indexed by the system (Apple Sequoia Advisory, Apple Sonoma Advisory).

Apple has released patches addressing this vulnerability in macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, and macOS Tahoe 26.3, all released on February 11, 2026. Users should update their macOS installations to these versions or later via System Settings > General > Software Update. No configuration-based workarounds have been published; upgrading to a patched version is the recommended and only known remediation (Apple Sequoia Advisory, Apple Sonoma Advisory, Apple Tahoe Advisory).

The vulnerability was reported by security researcher Mickey Jin (@patch1t), who is credited in all three Apple security advisories. No notable public commentary, media coverage, or community discussion specific to CVE-2026-20612 has been identified beyond standard vulnerability tracking and aggregation sites (Apple Tahoe Advisory).