Apple Patches Decade-Old iOS Zero-Day: dyld Exposed to…

Apple has fixed CVE-2026-20700, a vulnerability in dyld present for over a decade and exploited in targeted attacks. The exploit chain also involves CVE-2025-14174 and CVE-2025-43529 in WebKit, patched by Google a week earlier. The flaw, rated CVSS 7.8 HIGH, enables arbitrary code execution via memory corruption in the dynamic linker at the heart of Apple's OS ecosystem.

Apple released a patch on February 15, 2026 — referencing an update published Wednesday, February 11 — for CVE-2026-20700, a zero-day vulnerability in the iOS dyld (Dynamic Link Editor) component. The flaw, classified as CVSS 7.8 HIGH by the National Vulnerability Database, has been exploited in extremely sophisticated attacks against targeted individuals. The affected component is the dynamic linker that loads shared libraries into memory and connects application code to system frameworks: such a central surface makes the vulnerability particularly critical for the security of the entire mobile ecosystem.

Key Takeaways

CVE-2026-20700 is a memory corruption vulnerability in dyld, Apple's dynamic linker, exploitable for arbitrary code execution with CVSS 7.8 HIGH
Apple confirms in-the-wild exploitation in "extremely sophisticated attacks against specific targeted individuals" on iOS versions prior to 26
The vulnerability was identified jointly by Apple Security Team and Google Threat Analysis Group, with Google patching CVE-2025-14174 for Chrome a week before Apple
The decade-plus longevity estimate comes from Brian Milbier, deputy CISO of Huntress, who describes the patch as closing "a door that remained open for over ten years"

The Mechanism: Memory Corruption at the Heart of the System

According to SecurityWeek, CVE-2026-20700 affects the dyld component and the memory corruption "can be exploited for arbitrary code execution." The dossier does not specify the exact trigger mechanism nor provide details on the precise activation conditions. What is documented is the potential severity: the same source reports an Apple description that includes "information exposure, denial-of-service, arbitrary file write, privilege escalation, network traffic interception, sandbox escape, and code execution."

The nature of the dyld component — which operates at the system level during the loading of every application — amplifies the impact. This is not an isolated flaw in an app or peripheral framework, but an architectural element present in every process launch on iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. Apple has distributed patches for all these platforms: iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, visionOS 26.3, plus versions for legacy devices such as iOS 18.7.5 and iPadOS 18.7.5.

The Exploit Chain: From WebKit to the Kernel

The documented attack does not rely on CVE-2026-20700 in isolation. Apple explicitly links its exploitation to CVE-2025-14174 and CVE-2025-43529, two zero-days patched in WebKit in December 2025. According to SecurityWeek, CVE-2025-14174 is an out-of-bounds memory access vulnerability in Chrome/Angle that also impacts WebKit due to shared Angle library code, while CVE-2025-43529 is a use-after-free in WebKit. Both are rated CVSS 8.8 HIGH.

The sequence suggests a multi-stage attack: initial compromise via browser (WebKit/Chrome), followed by escalation through dyld to gain persistent control and elevated privileges. This attack architecture aligns with the modus operandi of commercial mercenary spyware, which typically combines surface vulnerabilities with privilege escalation flaws to maximize access and persistence on mobile devices.

The temporal coordination is significant: Google patched CVE-2025-14174 for Chrome a week before Apple's patches, indicating coordinated cross-platform disclosure. CISA has added CVE-2025-14174 to its KEV (Known Exploited Vulnerabilities) catalog, confirming active exploitation in the field.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report." — Apple Security Advisory

Commercial Spyware and the Market for iOS Flaws

SecurityWeek reports that "descriptions suggest they may have been exploited by commercial spyware vendors." The dossier does not identify the specific vendor: no infrastructure overlaps currently link the actor to NSO Group, Intellexa, or other known operators. The overall pattern — targeting of specific individuals, technical sophistication, multi-vulnerability chain — is however consistent with the mercenary segment of the spyware market.

The quote from Brian Milbier, deputy CISO of Huntress, published via Slashdot with reference to The Register, adds a critical temporal dimension: the patch "closes a door that remained open for over ten years." This estimate, while not independently verifiable from primary technical sources, indicates the dyld vulnerability long predates the current structured commercial spyware threat cycle. The flaw survived generations of Apple mitigations — including MIE (Memory Integrity Enforcement), PAC (Pointer Authentication Codes), and MTE (Memory Tagging Extension) documented on the security.apple.com blog — which had nonetheless reduced the memory corruption attack surface.

The contrast is stark: Apple presents its stack as "the most significant upgrade to memory safety," while a prehistoric vulnerability in the dynamic linker remained exploitable. This does not invalidate the defense technologies, but shows the limits of an entirely vendor-controlled security model: what is not visible to internal research or public bug bounty programs can persist for years, becoming raw material for operators capable of investing in long-term offensive research.

Why It Matters

The dossier does not specify the exact number of victims nor the geography of the attacks. The initial delivery vector of the exploit chain is not documented, nor is it clear whether the dyld vulnerability existed before iOS or was introduced with a specific version. The "nearly two decades" estimate is not supported by available sources: Huntress indicates "over a decade."

The brief does not document specific remedial measures beyond system updates. The source does not specify the nature of data exposed in confirmed attacks, nor provide indicators of compromise for forensic verification. The dossier does not list operational actions for already-compromised devices or for detection of past exploitation.

What remains documented is sufficient to outline a troubling picture: a systemic component of iOS, the world's most widely used mobile operating system, hosted a critical vulnerability for a timeframe measured in decades, surfacing only when the commercial spyware market made its exploitation too costly to ignore. The Apple-Google TAG collaboration worked for disclosure, but time-to-discovery remains an uncontrolled metric.

The Measure of the Walled Garden

For organizations managing iOS fleets, the episode raises structural questions. The "trust Apple only" model shows a blind spot: concentration of security research in a single vendor, however well-resourced, does not guarantee temporal coverage of all attack surfaces. The ecosystem's closure, touted as a defense, also becomes a factor limiting third-party visibility into components like dyld.

The contrast with the Chrome ecosystem — where Google's patch arrived a week earlier — suggests that cross-platform competition in tracking commercial spyware is becoming an acceleration factor. It is unclear whether this pattern will repeat systematically: the dossier does not document this. What is confirmed is that for this specific exploit chain, coordination worked, but with temporal asymmetries that left Apple users exposed longer.

For the cybersecurity sector, the incident reinforces the urgency of third-party security frameworks on mobile platforms and reducing time-to-patch, especially against threats accelerated by artificial intelligence — though the dossier does not directly link this vulnerability to the AI acceleration mentioned in contextual sources. For researchers, the value of cross-platform vendor collaboration is proven. For users, the implicit recommendation in Apple's advisory is immediate update: iOS 26.3 or, for unsupported devices, the indicated legacy versions.

Information is based on cited sources and current as of publication.

Sources

Sources and references