Apple Patches Decade-Old Zero-Day in iOS Core: dyld Exposed for…

CVE-2026-20700 affects the dyld dynamic linker, a fundamental component present for over a decade. Apple confirms targeted exploitation in a chain with two WebKit zero-days patched in December 2025.

Apple released patches on February 11, 2026 addressing CVE-2026-20700, a zero-day vulnerability in the dyld (Dynamic Link Editor) component of iOS and macOS. According to Brian Milbier, deputy CISO at Huntress, the patch "closes a door that has remained open for over a decade." Apple's confirmed exploitation describes "extremely sophisticated attacks against specific targeted individuals," a pattern sources indicate is typical of commercial mercenary spyware.

The vulnerability was exploited in a chain with CVE-2025-14174 and CVE-2025-43529, two WebKit zero-days patched in December 2025. All three flaws were jointly identified by the Apple Security Team and the Google Threat Analysis Group, in a rare example of cross-vendor coordination on actively exploited zero-days.

Key Takeaways

CVE-2026-20700 is a memory corruption in the dyld dynamic linker that enables arbitrary code execution, according to the Apple advisory and SecurityWeek
Apple confirms in-the-wild exploitation on iOS versions prior to 26, with attacks classified as "extremely sophisticated"
The dyld vulnerability persisted for over ten years before discovery, indicating a prolonged failure of detection processes on a critical component
Patches are available in iOS 26.3 and legacy releases for older devices; iOS 26.3 resolves approximately 40 vulnerabilities, macOS Tahoe 26.3 addresses over 50 security defects

The Mechanism: Memory Corruption in the Dynamic Linker

CVE-2026-20700 affects the dyld component, the dynamic linker responsible for loading and linking shared libraries across all Apple operating systems. According to Apple's official advisory, it is a memory corruption issue addressed with improved state management. SecurityWeek specifies the vulnerability can be exploited for arbitrary code execution.

dyld is a fundamental operating system component: it activates every time a process executes, managing symbol resolution and dynamic library loading. A compromise at this level allows interception and modification of the execution flow before the target application actually launches, making post-compromise detection particularly complex.

The Exploit Chain: From WebKit to the System Core

The attack documented by Apple does not rely on a single flaw but on a multi-stage chain. CVE-2025-14174, an out-of-bounds memory access in the Angle graphics library used by Blink (Chrome) and WebKit, and CVE-2025-43529 form the first links in the chain. According to the Apple advisory, both WebKit vulnerabilities were issued "in response to the same report" as CVE-2026-20700.

CVE-2025-14174 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming its active exploitation. Google patched this same vulnerability a week before Apple, highlighting a temporary differentiated exposure window across platforms. The pattern — browser entry point, escalation via system vulnerability — represents a consolidated technique in the mercenary spyware landscape.

The Decade of Technical Debt: What Apple Didn't Find

The vulnerability's estimated duration — over ten years, per Milbier's statement — raises concrete questions about the limits of Apple's security review processes. The vendor has invested in recent years in memory safety architectures like MIE (Memory Integrity Enforcement), designed to prevent exploitation of memory corruption at the hardware level. CVE-2026-20700 demonstrates, however, that these future mitigations do not resolve the technical debt accumulated on core components not yet migrated to memory-safe languages.

The case highlights a structural gap: iOS's closed ecosystem, which prevents installation of third-party EDR (Endpoint Detection and Response) tools, leaves users and enterprises exclusively dependent on Apple's internal detection capabilities. When these fail for over a decade on so central a component, the entire ecosystem security model is weakened.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26" — Apple Security Advisory

Immediate Actions

Update immediately to iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, or visionOS 26.3, as indicated by SecurityWeek
For devices not supported by the 26.x releases, apply iOS 18.7.5, iPadOS 18.7.5, macOS Sequoia 15.7.4, or macOS Sonoma 14.8.4
Check for CVE-2025-14174 in CISA's KEV catalog for any risk assessments on systems that cannot be updated promptly
Consider that iOS's closed ecosystem prevents third-party detection solutions; organizations with advanced threat hunting requirements must evaluate this limitation in their risk model

Questions and Answers

Why wasn't such an old vulnerability discovered earlier?

The brief does not specify the precise reasons for the missed detection. It is observed that dyld is a critical component subject to continuous review, but memory corruption in legacy code can evade both static and dynamic analysis when they do not present easily detectable anomalous access patterns. Apple has not released details on the process that led to the discovery.

Is my device at risk if I don't update immediately?

Apple confirms exploitation on versions prior to iOS 26. The source does not specify whether the attack was broad or rigidly targeted; the "extremely sophisticated attack against specific targeted individuals" pattern suggests victim selection, but does not exclude risks for users not directly targeted, especially if the exploit chain is reused.

Who is attributed as the commercial spyware attacker?

No source in the dossier publicly attributes the campaign to a specific vendor. SecurityWeek, reported by Slashdot, indicates that "descriptions suggest they may have been exploited by commercial spyware vendors." This is a pattern indication, not a confirmed attribution.

The CVE-2026-20700 case reveals a sector paradox: iOS's closed and controlled architecture, presented as a security advantage, can become a fragility point when the primary vendor fails to identify persistent vulnerabilities in its own fundamental components. The Google-Apple coordination on disclosure shows that even the industry's largest actors cannot address these threats autonomously. For organizations managing sensitive assets on Apple devices, the lesson is that "vendor trust" does not substitute for independent risk assessment, particularly in the absence of third-party visibility tools.

Sources

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references