CVE-2026-20629: 
macOS vulnerability analysis and mitigation

CVE-2026-20629 is a permissions vulnerability in Apple's Foundation framework on macOS Tahoe that allows a locally installed app to access user-sensitive data through insecure handling of temporary files. The vulnerability was disclosed on February 11, 2026, as part of Apple's macOS Tahoe 26.3 security update, with the advisory subsequently updated on March 24, 2026. It affects macOS Tahoe versions prior to 26.3 and was credited to researcher Asaf Cohen. The CVSS v3.1 base score is 5.5 (Medium) (Apple Advisory).

The root cause is classified as CWE-922 (Insecure Storage of Sensitive Information), specifically a privacy issue in the Foundation framework's handling of temporary files. Apple addressed the flaw with improved handling of temporary files, suggesting that sensitive data was being written to or accessible via temporary file paths without adequate access controls or permissions restrictions. The attack vector is local, requiring low privileges and no user interaction, meaning a malicious app already installed on the system could silently read sensitive user data from these temporary files (Apple Advisory).

Successful exploitation allows a malicious app to access user-sensitive data without the user's knowledge or consent, impacting confidentiality. There is no integrity or availability impact. The scope is limited to the local macOS system, but the data exposed could include sensitive information processed by the Foundation framework, potentially enabling privacy violations or data harvesting by a rogue application (Apple Advisory).

Apple has patched this vulnerability in macOS Tahoe 26.3, released February 11, 2026. Users should update to macOS Tahoe 26.3 or later via System Settings > General > Software Update. No configuration-based workarounds have been published; upgrading to the patched release is the only recommended remediation (Apple Advisory).

The vulnerability was noted in standard security community aggregators and vulnerability databases shortly after Apple's disclosure, with no significant independent researcher commentary or media coverage beyond routine patch reporting. The SANS Internet Storm Center diary entry referenced the advisory as part of Apple's February 2026 patch cycle (Apple Advisory).