CVE-2026-20637

MEDIUM

iOS and iPadOS < 18.7.7 - Use-After-Free

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-20637. PoCs published by zeroxjf, enfilade-labs.

AI-analyzed exploit summary The repository contains a functional proof-of-concept exploit for CVE-2026-20637, a use-after-free vulnerability in AppleSEPKeyStore. The exploit triggers a kernel panic by racing IOConnectCallMethod and IOServiceClose operations, demonstrating the vulnerability in iOS/macOS versions 26.1-26.2.

Description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An app may be able to cause unexpected system termination.

Exploits (2)

nomisec WORKING POC 49 stars
by zeroxjf · poc
https://github.com/zeroxjf/CVE-2026-20637-AppleSEPKeyStore-UAF

The repository contains a functional proof-of-concept exploit for CVE-2026-20637, a use-after-free vulnerability in AppleSEPKeyStore. The exploit triggers a kernel panic by racing IOConnectCallMethod and IOServiceClose operations, demonstrating the vulnerability in iOS/macOS versions 26.1-26.2.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Racy
Target: AppleSEPKeyStore (com.apple.driver.AppleSEPKeyStore) on iOS/macOS 26.1-26.2
No auth needed
Prerequisites: Access to a vulnerable iOS/macOS device (versions 26.1-26.2) · Ability to execute code on the target device
devstral-2 · analyzed Apr 09, 2026 Full analysis →
nomisec WORKING POC
by enfilade-labs · poc
https://github.com/enfilade-labs/CVE-2026-20637-AppleSEPKeyStore-UAF

This repository contains a functional proof-of-concept exploit for CVE-2026-20637, a use-after-free vulnerability in AppleSEPKeyStore. The exploit triggers a kernel panic by racing IOConnectCallMethod and IOServiceClose operations, demonstrating the vulnerability in iOS and macOS versions 26.1 to 26.2.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Racy
Target: AppleSEPKeyStore (com.apple.driver.AppleSEPKeyStore) on iOS 26.1-26.2 and macOS 26.1-26.2
No auth needed
Prerequisites: Physical iOS device (simulator will not reach the driver) · Xcode for building and running the exploit
devstral-2 · analyzed Apr 23, 2026 Full analysis →

References (8)

Core 8

Scores

CVSS v3 6.2
EPSS 0.0020
EPSS Percentile 9.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-416
Status published
Products (14)
Apple/iOS and iPadOS < 18.7.7
Apple/iOS and iPadOS < 26.3
apple/ipados < 18.7.7
apple/iphone_os < 18.7.7
Apple/macOS < 14.8.5
Apple/macOS < 15.7.5
Apple/macOS < 26.3
apple/macos 14.0 - 14.8.5
Apple/tvOS < 26.3
apple/tvos < 26.3
... and 4 more
Published Mar 25, 2026
Tracked Since Mar 25, 2026