CVE-2026-20646: 
macOS vulnerability analysis and mitigation

CVE-2026-20646 is a privacy/tracking vulnerability in Apple's Weather component on macOS Tahoe that allows a malicious app to read sensitive location information. The root cause is a logging issue that was addressed with improved data redaction. It affects macOS Tahoe versions prior to 26.3 and was disclosed on February 11, 2026, with the patch released as part of macOS Tahoe 26.3. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) (Apple Advisory).

The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File), where the Weather app on macOS Tahoe improperly logged sensitive location data in a manner accessible to malicious applications. The attack vector is local (AV:L), requiring low privileges and no user interaction, meaning a locally installed malicious app could read log entries containing location information without explicit user consent. Apple addressed the issue through improved data redaction in log entries (Apple Advisory). The vulnerability was discovered and reported by Morris Richman (@morrisinlife).

Successful exploitation allows a malicious app to read sensitive location information logged by the Weather component, representing a confidentiality impact limited to location data. There is no integrity or availability impact. The scope is confined to the local system, and the risk is primarily a privacy violation — an attacker with a locally installed app could infer a user's location without explicit permission (Apple Advisory).

Apple has released a patch in macOS Tahoe 26.3 (released February 11, 2026), which addresses the logging issue through improved data redaction. Users should update to macOS Tahoe 26.3 or later as the primary remediation. No configuration-based workarounds have been published; upgrading is the recommended and only known fix (Apple Advisory).