CVE-2026-20651: 
macOS vulnerability analysis and mitigation

CVE-2026-20651 is a privacy vulnerability in the Messages component of Apple macOS caused by insecure handling of temporary files (CWE-377). It allows a local app to access sensitive user data without authorization. The vulnerability affects macOS Sonoma (14.0–14.8.4), macOS Sequoia (15.0–15.7.5), and macOS Tahoe (26.0–26.3). It was disclosed by Apple on March 24, 2026, and credited to Chunyu Song of NorthSea. It carries a CVSS v3.1 base score of 6.2 (Medium) (Apple Advisory 126795, Apple Advisory 126350, Apple Advisory 126348).

The root cause is classified as CWE-377 (Insecure Temporary File), where the Messages component creates or uses temporary files with insufficient access controls, allowing other apps to read their contents. The attack vector is local (AV:L), requires no privileges (PR:N) and no user interaction (UI:N), and has low attack complexity (AC:L). An attacker-controlled app running on the same system could monitor or read improperly secured temporary files created by Messages, potentially exposing sensitive user data such as message content or attachments. No public proof-of-concept or technical write-up detailing the specific exploitation mechanism has been published (Apple Advisory 126795, Apple Advisory 126350).

Successful exploitation results in a high confidentiality impact — a local app can read sensitive user data handled by the Messages application, such as message content or associated files, without user knowledge or consent. There is no integrity or availability impact. The scope is limited to the local system, but the exposed data could include private communications, potentially enabling further social engineering or targeted attacks (Apple Advisory 126795, Apple Advisory 126348).

Apple has released patches addressing this vulnerability across all affected macOS branches. Users should update to macOS Sonoma 14.8.5 or later, macOS Sequoia 15.7.5 or later, or macOS Tahoe 26.3 or later. No configuration-based workarounds have been published; upgrading to a patched release is the only recommended remediation (Apple Advisory 126795, Apple Advisory 126350, Apple Advisory 126348).

The vulnerability was noted in broader coverage of Apple's March 2026 security update cycle, which addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and tvOS. CIS published an advisory noting multiple vulnerabilities in Apple products that could allow for privilege escalation. No significant individual researcher commentary or social media discussion specific to CVE-2026-20651 has been identified beyond standard patch reporting.