CVE-2026-20637

MEDIUM

Apple Ios And Ipados < 18.7.7 - Denial of Service

Title source: rule

Description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An app may be able to cause unexpected system termination.

Exploits (2)

nomisec WORKING POC 49 stars

by zeroxjf · poc

https://github.com/zeroxjf/CVE-2026-20637-AppleSEPKeyStore-UAF

View Code ZIP pw:eip

nomisec WORKING POC

by enfilade-labs · poc

https://github.com/enfilade-labs/CVE-2026-20637-AppleSEPKeyStore-UAF

View Code ZIP pw:eip

References (8)

https://support.apple.com/en-us/126346

https://support.apple.com/en-us/126348

https://support.apple.com/en-us/126351

https://support.apple.com/en-us/126352

https://support.apple.com/en-us/126353

https://support.apple.com/en-us/126793

https://support.apple.com/en-us/126795

https://support.apple.com/en-us/126796

Scores

CVSS v3 6.2

EPSS 0.0001

EPSS Percentile 2.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-416

Status published

Products (14)

Apple/iOS and iPadOS < 18.7.7

Apple/iOS and iPadOS < 26.3

apple/ipados < 18.7.7

apple/iphone_os < 18.7.7

Apple/macOS < 14.8.5

Apple/macOS < 15.7.5

Apple/macOS < 26.3

apple/macos 14.0 - 14.8.5

Apple/tvOS < 26.3

apple/tvos < 26.3

... and 4 more

Published Mar 25, 2026

Tracked Since Mar 25, 2026