CVE-2026-20625: 
macOS vulnerability analysis and mitigation

CVE-2026-20625 is a path traversal vulnerability (CWE-22) in the AppleMobileFileIntegrity component of Apple macOS and visionOS. A parsing issue in the handling of directory paths allows a malicious app to access sensitive user data. The vulnerability affects macOS Sonoma (versions before 14.8.4), macOS Sequoia (versions before 15.7.4), macOS Tahoe (versions before 26.3), and visionOS (versions before 26.3). It was disclosed and patched on February 11, 2026, with credits to Mickey Jin (@patch1t) and Ryan Dowd (@_rdowd). The CVSS v3.1 base score is 5.5 (Medium) (Apple Advisory macOS Tahoe, Apple Advisory macOS Sonoma, Apple Advisory visionOS).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 / Path Traversal), specifically a parsing flaw in how the AppleMobileFileIntegrity subsystem handles directory paths. An attacker-controlled app can supply crafted path inputs that bypass the intended directory restrictions, enabling access to files or directories outside the sanctioned scope. Exploitation requires local access and user interaction (e.g., a user running a malicious app), with no privileges required. Apple addressed the issue with improved path validation (Apple Advisory macOS Tahoe, Apple Advisory macOS Sequoia).

Successful exploitation allows a malicious app to read sensitive user data that it should not have access to, resulting in a high confidentiality impact. There is no integrity or availability impact — the vulnerability is limited to unauthorized data disclosure. Affected data could include personal files, credentials, or other protected user information stored on the device, depending on the directories accessible via the traversal (Apple Advisory macOS Tahoe, Apple Advisory visionOS).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later:

• macOS Sonoma 14.8.4
• macOS Sequoia 15.7.4
• macOS Tahoe 26.3
• visionOS 26.3

No configuration-based workarounds have been published. The recommended remediation is to apply the available OS updates via System Settings > Software Update as soon as possible (Apple Advisory macOS Sonoma, Apple Advisory macOS Sequoia, Apple Advisory macOS Tahoe, Apple Advisory visionOS).

The vulnerability was noted in standard security community channels following Apple's February 11, 2026 patch release. It was referenced in SANS ISC diary entries and picked up by vulnerability aggregators shortly after disclosure. No notable independent researcher commentary or significant media coverage specific to this CVE has been identified beyond routine patch-day reporting (SANS ISC).