CVE-2026-20617: 
macOS vulnerability analysis and mitigation

CVE-2026-20617 is a race condition vulnerability in Apple's CoreServices component that allows a locally installed app to gain root privileges. It was disclosed and patched on February 11, 2026, affecting iOS and iPadOS (before 26.3), macOS Sonoma (before 14.8.4), macOS Tahoe (before 26.3), tvOS (before 26.3), visionOS (before 26.3), and watchOS (before 26.3). The vulnerability carries a CVSS v3.1 base score of 7.0 (High) (Apple iOS/iPadOS Advisory, Apple macOS Sonoma Advisory).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition) and resides in Apple's CoreServices framework. An attacker-controlled app can exploit a time-of-check to time-of-use (TOCTOU) style race condition — related to CAPEC-29 — by manipulating shared state during a window of opportunity between a security check and the subsequent privileged operation, ultimately escalating to root. Exploitation requires a low-privileged local attacker with no user interaction, though the high attack complexity reflects the timing-dependent nature of the race. The vulnerability was discovered and reported by Golden Helm Securities, Gergely Kalman (@gergely_kalman), and Csaba Fitzl (@theevilbit) of Iru (Apple iOS/iPadOS Advisory, Apple watchOS Advisory).

Successful exploitation allows a malicious app to escalate privileges to root on the affected device, resulting in high confidentiality, integrity, and availability impact. An attacker achieving root access could read or modify any data on the device, install persistent malware, disable security controls, or pivot to other connected systems. The vulnerability affects a broad range of Apple platforms — iPhone, iPad, Mac, Apple Watch, Apple TV, and Apple Vision Pro — significantly widening the potential attack surface (Apple iOS/iPadOS Advisory, Apple macOS Sonoma Advisory, Apple visionOS Advisory).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: iOS 26.3 and iPadOS 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3. No configuration-based workarounds are available; updating to a patched OS version is the only recommended remediation. Updates can be applied via Settings > General > Software Update on iOS/iPadOS/watchOS/tvOS/visionOS, or System Settings > General > Software Update on macOS (Apple iOS/iPadOS Advisory, Apple macOS Sonoma Advisory, Apple watchOS Advisory).

The February 2026 Apple security update batch received broad coverage from security news outlets, with several noting the simultaneous patching of over 90 vulnerabilities across Apple's ecosystem. Security researchers Gergely Kalman (@gergely_kalman) and Csaba Fitzl (@theevilbit) of Iru, who were credited for discovering CVE-2026-20617, are well-known macOS/iOS security researchers with a track record of privilege escalation research. Community discussion on Mastodon and security blogs highlighted the update's scope, though CVE-2026-20617 itself did not attract outsized individual attention compared to the actively exploited dyld vulnerability (CVE-2026-20700) patched in the same release (Apple iOS/iPadOS Advisory).