Apple Patches CVE-2026-20700: Zero-Day in dyld Survived Two…

Apple has fixed CVE-2026-20700, a zero-day memory corruption vulnerability in the dyld dynamic linker that existed in iOS for over a decade. The flaw was exploited in extremely sophisticated attacks against specific targeted individuals, chained with two WebKit zero-days patched in December 2025.

On February 11, 2026, Apple released patches for CVE-2026-20700, a zero-day memory corruption vulnerability in dyld, the dynamic linker that every iOS app invokes at launch. The flaw, present in the operating system for over a decade and potentially for nearly two decades, was exploited in extremely sophisticated attacks against specific targeted individuals, chained with two WebKit zero-days already patched in December 2025.

Key Takeaways

CVE-2026-20700 is a memory corruption in Apple's dyld: an attacker with memory write capability achieves arbitrary code execution
Apple confirms exploitation in the wild in "extremely sophisticated attack against specific targeted individuals" on versions prior to iOS 26
The attack chain involves CVE-2025-14174 and CVE-2025-43529, two WebKit zero-days identified by Apple Security Team and Google Threat Analysis Group
Patched versions include iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, visionOS 26.3, plus legacy releases for older devices

dyld: A Single Point of Failure for Two Decades of Updates

The Dynamic Link Editor (dyld) is the system component responsible for loading dynamic libraries into memory. Every iOS application, from the first iPhone OS in 2007 onward, depends on this mechanism to resolve symbols and link executable code. The universal nature of dyld makes it an exceptionally high-value target for sophisticated attackers: compromising it means compromising the entry point of every user process.

According to Apple's official advisory, CVE-2026-20700 is a "memory corruption issue" addressed with "improved state management." The stated impact is direct: "attacker with memory write capability may be able to execute arbitrary code." The phrasing "with memory write capability" indicates the vulnerability is not remotely reachable in isolation but requires a prerequisite of memory access, typically obtained through another flaw—in this case, the two WebKit zero-days.

Brian Milbier, deputy CISO at Huntress, commented that the patch "closes a door that has been unlocked for over a decade." A Slashdot observer noted that, if this timeline is accurate, Chrome—which shares a codebase lineage with WebKit—would have been exposed for a comparable period. The dossier does not document the exact date the vulnerability was introduced into the codebase, nor does it independently confirm the "nearly two decades" duration versus "over a decade."

The Multi-Stage Chain: From WebKit to the Operating System

Exploitation of CVE-2026-20700 did not occur in isolation. Apple explicitly links the dyld flaw to "attacks involving CVE-2025-14174 and CVE-2025-43529," two WebKit zero-days patched in December 2025. This attack architecture reflects the classic mercenary spyware pattern: an initial compromise of the browser or rendering engine to obtain memory write primitives, followed by escalation to the kernel or system components via vulnerabilities like the one in dyld.

According to SecurityWeek, the descriptions of the three vulnerabilities "suggest that they might have been exploited by commercial spyware vendors." The joint discovery pattern by Apple Security Team and Google Threat Analysis Group is historically associated with this type of threat. The dossier does not identify the specific vendor, nor does it provide the number of victims. Apple describes the attacks as "extremely sophisticated" and directed at "specific targeted individuals," ruling out mass exploitation.

CVE-2025-14174 is a memory corruption in WebKit's Angle graphics library with a CVSS of 8.8; CVE-2025-43529 is a use-after-free in the same component, with an identical score. Both allow arbitrary code execution in the browser context, paving the way for the subsequent compromise of dyld.

Reactive Patching Meets the Limits of Time

The February 2026 release resolves CVE-2026-20700 on iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, and the tvOS, watchOS, and visionOS variants. For devices incompatible with the main releases, Apple issued iOS 18.7.5, iPadOS 18.7.5, macOS Sequoia 15.7.4, and macOS Sonoma 14.8.4. The cited advisory does not specify whether the dyld vulnerability was present in all intermediate versions.

In the same update, iOS and iPadOS 26.3 address "nearly 40 vulnerabilities," while macOS Tahoe 26.3 fixes "over 50 security defects," according to SecurityWeek. These numbers contextualize CVE-2026-20700 within a broad patching cycle, without diminishing the specific severity of an actively exploited zero-day.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26" — Apple Support Advisory, CVE-2026-20700

Memory Integrity Enforcement: Apple's Structural Response

The persistence of a memory corruption vulnerability in such a fundamental component raises questions about the limits of reactive patching. In June 2026, following the event, Apple published a technical treatment on security.apple.com covering Memory Integrity Enforcement (MIE), PAC (Pointer Authentication Codes), and EMTE (Enhanced Memory Tagging Extension). The document does not directly describe CVE-2026-20700 but states that "the only system-level iOS attacks we observe in the wild come from mercenary spyware, which is vastly more complex than regular cybercriminal activity and consumer malware."

MIE represents the evolution of Apple's strategy: instead of individually fixing every memory safety bug, the hardware-software architecture prevents manipulation of pointers and allocation metadata even in the presence of undiscovered vulnerabilities. The simultaneous existence of CVE-2026-20700 for twenty years and the introduction of MIE in 2026 illustrates the transition from a defense based on response speed to one based on reducing the intrinsic attack surface.

Why It Matters

The dossier does not document specific remedial measures for users beyond updating the operating system. The source does not specify whether the vulnerability was introduced in iPhone OS 1.0 or a later release, nor does it provide full technical details of the dyld-WebKit exploitation chain mechanism. The CVSS score is not reported in the available sources, although the CVE-2026-20700 record in the National Vulnerability Database assigns 7.8 HIGH.

The source does not identify the commercial spyware vendor involved, nor the exact number of targeted individuals. No confirmation emerges that the same vulnerability was present in non-Apple codebases, although the Slashdot comment suggests a possible historical overlap with Chrome through the WebKit lineage.

The absence of decade-long security audits on components like dyld remains a structural limitation of the industry: patches accumulate, but fundamental code receives scrutiny only when a flaw emerges in real-world attacks.

Apple has fixed the vulnerability. The duration of the exposure window, however, is a metric the security industry can no longer afford to ignore.

Information is based on the cited source and current as of publication.

Sources

Sources and references