Apple Patches Zero-Day in dyld: A Flaw Hidden for Over a Decade

CVE-2026-20700 carries a CVSS 7.8 rating and is actively exploited against targeted individuals. Apple released patches on February 11, 2026 for iOS, macOS, and other platforms.

Apple released security updates on February 11, 2026 to address CVE-2026-20700, an actively exploited zero-day vulnerability in the dyld (Dynamic Link Editor) component of its operating systems. The flaw, rated CVSS 7.8 by CISA-ADP per the NVD record, is described as a memory corruption issue.

As reported by Slashdot citing SecurityWeek, Brian Milbier, deputy CISO at Huntress, commented that the patch "closes a door that has been open for over a decade." The discovery is credited to the Google Threat Analysis Group (TAG).

Key Takeaways

CVE-2026-20700 is a zero-day vulnerability in dyld, Apple's dynamic linker, with CVSS 7.8 and vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H per CISA-ADP in the NVD record.
Apple confirms exploitation in an "extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26"; the discovery is attributed to Google Threat Analysis Group (TAG).
Patches released February 11, 2026 cover iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3, plus specific legacy versions.
The same attack campaign employed two other zero-days already patched in December 2025: CVE-2025-14174 (out-of-bounds in ANGLE Metal renderer, CVSS 8.8) and CVE-2025-43529 (use-after-free in WebKit, CVSS 8.8).

The Mechanism: What Is dyld and How the Vulnerability Works

Dyld is Apple's dynamic linker: it loads shared libraries, resolves symbols, and manages memory mapping for every process. The Apple advisory for iOS 26.3 describes the fix as "a memory corruption issue was addressed with improved state management."

The CVSS vector confirms the local nature of the issue: AV:L (Attack Vector: Local), with PR:L (Privileges Required: Low) and no user interaction required (UI:N). CISA-ADP in the NVD record classifies the vulnerability as CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

Apple has not published additional technical details on trigger conditions. The local nature of the vulnerability suggests the attacker already needs a foothold on the device, consistent with the documented targeted attack model.

The Attack Campaign: Three Linked Zero-Days

The verbatim text of the Apple advisory, cited by The Hacker News, states that the same Google TAG report generated three distinct CVE identifiers. CVE-2026-20700 is the local element of the chain; CVE-2025-14174 and CVE-2025-43529, already fixed in December 2025, provide the initial vectors.

The first is an out-of-bounds in the ANGLE Metal renderer, with CVSS 8.8; the second is a use-after-free in WebKit, also with CVSS 8.8. Both were patched by Apple on December 16, 2025.

Apple does not name specific operators nor confirm attribution to spyware vendors. Slashdot, citing SecurityWeek, reports that the attack descriptions "suggest that they might have been exploited by commercial spyware vendors." This is an external source hypothesis, not a vendor confirmation.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26." — Apple Inc., security advisory

The CISA Catalog and the Federal Patch Mandate

The NVD record for CVE-2026-20700 shows inclusion in the CISA Known Exploited Vulnerabilities Catalog with date March 5, 2026, per Binding Operational Directive 22-01. U.S. federal agencies must apply mitigations by that deadline.

CISA-ADP assigns a score of 7.8, while the NVD's own assessment is "N/A." Presence in the KEV elevates CVE-2026-20700 from a technical vulnerability to an IT governance issue. For organizations with U.S. presence or federal contracts, the March 5 deadline is binding.

Historical context is relevant: in 2025 Apple patched 9 zero-days exploited in the wild. CVE-2026-20700 is the first actively exploited zero-day patched by Apple in 2026.

What to Do Now

Update immediately to iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, or visionOS 26.3; on devices incompatible with the main release, check availability of iOS 18.7.5, iPadOS 18.7.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, or Safari 26.3 per Apple release notes.
Verify CISA KEV compliance if the organization falls under Binding Operational Directive 22-01: the deadline for CVE-2026-20700 is March 5, 2026.
Monitor pre-iOS 26 devices: Apple specifies that documented attacks targeted versions prior to iOS 26.
Consult Apple advisories for details on supported models and available legacy versions.

Context and Source Limitations

The dossier relies on a structured primary source (the Apple advisory for iOS 26.3), a specialized journalistic source (The Hacker News), and expert analysis cited by secondary sources (Slashdot/SecurityWeek). Apple has not confirmed the precise timeline of the bug's introduction into the codebase: the "decade-old" claim rests on Milbier's statement, not on independently verifiable technical analysis.

Details on the full exploit chain, victim count, or attack geography are unavailable. Apple has not released specific indicators of compromise (IoCs) nor confirmed the identity of the attack operators.

Information verified against cited sources and current as of publication.

Sources

Sources and references