CVE-2026-20637: 
macOS vulnerability analysis and mitigation

CVE-2026-20637 is a use-after-free vulnerability in Apple's AppleKeyStore component that allows a malicious app to cause unexpected system termination. It affects iOS and iPadOS (before 18.7.7 and before 26.3), macOS Sequoia (before 15.7.5), macOS Sonoma (before 14.8.5), macOS Tahoe (before 26.3), tvOS (before 26.3), visionOS (before 26.3), and watchOS (before 26.3). The vulnerability was disclosed on March 24, 2026, and credited to Johnny Franks (zeroxjf) and an anonymous researcher. It carries a CVSS v3.1 base score of 6.2 (Medium) (Apple Advisory iOS 26.3, Apple Advisory macOS Tahoe 26.3).

The vulnerability is classified as CWE-416 (Use After Free) and resides in the AppleKeyStore subsystem, which handles cryptographic key management on Apple platforms. A use-after-free condition occurs when memory that has been freed is subsequently accessed, potentially allowing an attacker-controlled app to trigger a memory corruption condition leading to system termination. The attack vector is local (AV:L), requires no privileges (PR:N), and no user interaction (UI:N), meaning a locally installed malicious app can trigger the flaw without any additional user action. Apple addressed the issue with improved memory management (Apple Advisory iOS 26.3, Apple Advisory tvOS 26.3).

Successful exploitation results in an unexpected system termination (denial of service), crashing the affected device. The impact is limited to availability — there is no known confidentiality or integrity impact associated with this vulnerability. Because the flaw resides in the AppleKeyStore component, which is involved in cryptographic operations, repeated exploitation could disrupt security-sensitive operations on affected devices (Apple Advisory watchOS 26.3, Apple Advisory visionOS 26.3).

Apple has released patches across all affected platforms. Users should update to the following versions or later: iOS 18.7.7, iPadOS 18.7.7, iOS 26.3, iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3. No configuration-based workaround is available; updating to a patched version is the only remediation. As an interim measure, restricting installation of apps from untrusted sources reduces exposure (Apple Advisory iOS 26.3, Apple Advisory macOS Tahoe 26.3).

The vulnerability was noted in broader coverage of Apple's March 2026 security update cycle, which addressed over 140 vulnerabilities across Apple platforms. Security aggregators such as BeyondMachines and ISC SANS highlighted the update batch, though CVE-2026-20637 itself did not receive significant standalone attention given its medium severity and denial-of-service-only impact. The iOS 18.7.7 update received additional media coverage in the context of Apple's DarkSword exploit protections, with outlets such as CyberInsider and CyberSecurityNews covering the expanded rollout to more devices.