CVE-2026-20670: 
macOS vulnerability analysis and mitigation

CVE-2026-20670 is an authorization issue in the AppleEvents subsystem of macOS that allows a locally installed app to access sensitive user data without proper authorization. The vulnerability was disclosed by Apple on February 11, 2026, and credited to researcher Noah Gregory (wts.dev). It affects macOS Sonoma versions before 14.8.4 and macOS Tahoe versions before 26.3. The CVSS v3.1 base score is 5.5 (Medium), reflecting a local attack vector with low privileges required and high confidentiality impact (Apple Advisory 126348, Apple Advisory 126350).

The root cause is an authorization issue (improper state management) in the AppleEvents framework, which handles inter-application communication on macOS. Apple's description notes it was "addressed with improved state management," indicating that the vulnerability stemmed from insufficient authorization checks during AppleEvents processing, potentially allowing an app to send or intercept Apple Events targeting other applications and thereby read sensitive user data. The CWE classification aligns with CWE-863 (Incorrect Authorization). Exploitation requires a locally running app with low privileges and no user interaction (Apple Advisory 126348, Apple Advisory 126350).

Successful exploitation allows a malicious app to access sensitive user data handled by the AppleEvents subsystem, which facilitates inter-process communication between macOS applications. This could expose private information such as clipboard contents, application data, or user credentials passed between apps via Apple Events. The impact is limited to confidentiality — there is no integrity or availability impact — and exploitation is constrained to the local system without privilege escalation (Apple Advisory 126348, Apple Advisory 126350).

Apple has released patches addressing this vulnerability in macOS Sonoma 14.8.4 and macOS Tahoe 26.3, both released on February 11, 2026. Users should update their macOS systems to these versions or later via System Settings > Software Update. No configuration-based workarounds have been published by Apple. Organizations should also review installed third-party applications for suspicious behavior involving inter-application communication (Apple Advisory 126348, Apple Advisory 126350).