Apple watchOS 26.3 Security Update: 14 CVEs including RCE, Sandbox Escape, DoS

Security Content in watchOS 26.3 Release Date: February 11, 2026 Version: watchOS 26.3 Affected Devices: Apple Watch Series 6 and later Vulnerability Key Information 1. Bluetooth - CVE: CVE-2026-20650 - Impact: Attackers in a privileged network position could cause a denial-of-service attack - Description: Fixed denial-of-service issue via improved validation 2. CoreAudio - CVE: CVE-2026-20611 - Impact: Processing maliciously crafted media files could lead to unexpected application termination or process memory corruption - Description: Fixed out-of-bounds access issue via improved boundary checking 3. CoreMedia - CVE: CVE-2026-20609 - Impact: Processing maliciously crafted files could lead to denial-of-service or memory content leakage - Description: Fixed issue via improved memory handling 4. CoreServices - CVE: CVE-2026-20617 - Impact: Applications could gain root privileges - Description: Fixed race condition issue via improved state handling 5. CoreServices - CVE: CVE-2026-20627 - Impact: Applications could access sensitive user data - Description: Fixed issue in environment variable handling via improved validation 6. dyld - CVE: CVE-2026-20700 - Impact: Attackers with memory write capabilities could execute arbitrary code - Description: Fixed memory corruption issue via improved state management 7. Game Center - CVE: CVE-2026-20649 - Impact: Users could view sensitive user information - Description: Fixed logging issue via improved data erasure 8. ImageIO - CVE: CVE-2026-20675, CVE-2026-20634 - Impact: Processing maliciously crafted images could lead to user information leakage - Description: Fixed issues via improved boundary checking and memory handling 9. Kernel - CVE: CVE-2026-20654, CVE-2026-20671 - Impact: Applications could cause unexpected system termination; attackers could intercept network traffic - Description: Fixed issues via improved memory handling and logic checks 10. libexpat - CVE: CVE-2025-59375 - Impact: Processing maliciously crafted files could lead to denial-of-service - Description: This is a vulnerability in open-source code; CVE-ID assigned by third party 11. libxpc - CVE: CVE-2026-20667 - Impact: Applications could bypass sandbox restrictions - Description: Fixed logic issue via improved checking 12. Sandbox - CVE: CVE-2026-20628 - Impact: Applications could bypass sandbox restrictions - Description: Fixed permission issue via added restrictions 13. StoreKit - CVE: CVE-2026-20641 - Impact: Applications could identify other applications installed by the user - Description: Fixed privacy issue via improved checking 14. WebKit - CVE: CVE-2026-20635 - Impact: Processing maliciously crafted web content could lead to unexpected process crashes - Description: Fixed issue via improved memory handling

Goal Reached Thanks to every supporter — we hit 100%!

Apple watchOS 26.3 Security Update: 14 CVEs including RCE, Sandbox Escape, DoS