Apple tvOS 26.3 Security Update: 15 CVEs Fixed (Bluetooth, CoreAudio, WebKit, Kernel)

Key Information Summary Security Content for tvOS 26.3: - Release Date: February 11, 2026 - Applies to: Apple TV HD and Apple TV 4K (all models) Vulnerability Details: Bluetooth - CVE-2026-20650 - Impact: An attacker with network access could use specially crafted Bluetooth packets to perform a denial-of-service attack. - Description: Resolved via improved validation. - Reported by: jioundai CoreAudio - CVE-2026-20611 - Impact: Processing specially crafted media files may cause an application to terminate unexpectedly or corrupt process memory. - Description: Fixed by improving boundary checks to address out-of-bounds access. - Reported by: Anonymous, in collaboration with Trend Micro Zero Day Initiative CoreMedia - CVE-2026-20609 - Impact: Processing specially crafted files may lead to service denial or potential memory content disclosure. - Description: Resolved by improving memory handling. - Reported by: Yiğit Can YILMAZ (@yilmazcanyigit) CoreServices - CVE-2026-20617 - Impact: Applications may gain root privileges. - Description: Fixed by improving state handling to resolve race condition issues. - Reported by: Gergely Kalman (@gergely_kalman), Csaba Fitzl (@theevilbit), and Iru dyld - CVE-2026-20700 - Impact: An attacker with memory write capabilities could execute arbitrary code. - Description: Resolved by improving memory state management. - Reported by: Google Threat Analysis Group Game Center - CVE-2026-20649 - Impact: Users may be able to view sensitive user information. - Description: Fixed by improving data protection for logging. - Reported by: Asaf Cohen ImageIO - CVE-2026-20675 - Impact: Processing specially crafted images may lead to user information disclosure. - Description: Fixed by improving boundary checks. - Reported by: George Karchemsky (@gkarchemsky), in collaboration with Trend Micro Zero Day Initiative - CVE-2026-20634 - Impact: Processing specially crafted images may result in memory leaks. - Description: Fixed by improving memory handling. - Reported by: George Karchemsky (@gkarchemsky), in collaboration with Trend Micro Zero Day Initiative Kernel - CVE-2026-20654 - Impact: Applications may cause the system to terminate unexpectedly. - Description: Fixed by improving memory handling. - Reported by: Jian Lee (@speedyfriend433) - CVE-2026-20671 - Impact: An attacker with network access could intercept network traffic. - Description: Fixed by improving logic checks. - Reported by: Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef libexpat - CVE-2025-59375 - Impact: Processing specially crafted files may lead to service denial. - Description: This is a vulnerability in open-source code; CVE-ID assigned by the discoverer. - Reported by: Third party Sandbox - CVE-2026-20628 - Impact: Applications may bypass sandbox restrictions. - Description: Fixed by adding stricter permission controls. - Reported by: Noah Gregory StoreKit - CVE-2026-20641 - Impact: Applications may determine other applications installed by the user. - Description: Fixed by improving checks to address privacy concerns. - Reported by: Gongyu Ma (@Mezone0) WebKit - CVE-2026-20635 - Impact: Processing specially crafted web content may cause a process to crash unexpectedly. - Description: Fixed by improving memory handling. - Reported by: EntryHi

Goal Reached Thanks to every supporter — we hit 100%!

Apple tvOS 26.3 Security Update: 15 CVEs Fixed (Bluetooth, CoreAudio, WebKit, Kernel)