A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3. A shortcut may be able to bypass sandbox restrictions.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apple | macOS | affected |
|
||||||
| Apple | visionOS | affected |
|
||||||
| Apple | macOS | affected |
|
||||||
| Apple | iOS and iPadOS | affected |
|
||||||
| Apple | iOS and iPadOS | affected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 11 Feb 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3. A shortcut may be able to bypass sandbox restrictions. | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: apple
Published:
Updated: 2026-02-11T22:58:18.222Z
Reserved: 2025-11-11T14:43:07.872Z
Link: CVE-2026-20677
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-02-11T23:16:10.107
Modified: 2026-02-11T23:16:10.107
Link: CVE-2026-20677
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.