visionOS 26.3 Security Update: dyld RCE, Kernel Privilege Escalation CVEs

Key Information Summary Version Information - visionOS 26.3, Release Date: February 11, 2026 Affected Components and Vulnerability Descriptions - AppleMobileFileIntegrity - CVE-2026-20625: Issue in parsing directory paths that could allow apps to access sensitive user data. - Bluetooth - CVE-2026-20650: Improved validation resolves a denial-of-service issue. - CFNetwork - CVE-2026-20660: Path handling issue that could allow remote users to write arbitrary files. - CoreAudio - CVE-2026-20611: Processing malicious media files could lead to app crashes or process memory corruption. - CoreMedia - CVE-2026-20609: Processing malicious files could result in denial of service or memory content leakage. - CoreServices - CVE-2026-20615 and CVE-2026-20617: Vulnerabilities that could allow apps to gain root privileges. - CVE-2026-20627: Issue in handling environment variables that could allow apps to access sensitive user data. - dyld - CVE-2026-20700: Memory corruption issue that could allow attackers to execute arbitrary code. - ImageIO - CVE-2026-20634 and CVE-2026-20675: Processing malicious image files could lead to user information leakage or process memory leakage. - Kernel - Multiple CVEs, including CVE-2026-20654 and CVE-2026-20626, involving system crashes, gaining root privileges, and intercepting network traffic. - libexpat - CVE-2025-59375: Vulnerability in open-source code that could lead to denial of service. - Messages - CVE-2026-20677: Shortcuts could bypass sandbox restrictions. - Model I/O - CVE-2026-20616: Processing malicious USD files could cause app crashes. - Sandbox - CVE-2026-20628: Permission issue that could allow apps to break sandbox restrictions. - Shortcuts - CVE-2026-20653: Path handling issue that could allow apps to access sensitive user data. - StoreKit - CVE-2026-20641: Privacy issue that could allow apps to identify other apps installed by the user. - WebKit - Multiple CVEs, including CVE-2026-20652 and CVE-2026-20608, involving remote denial of service, user tracking, and process crashes. Special Note - The vulnerability CVE-2026-20700 in the dyld component has been reported to potentially enable highly complex, targeted attacks against specific users on iOS versions prior to iOS 26. Acknowledgments - Apple acknowledges contributions from academia, security research organizations, and individual researchers for identifying and helping resolve vulnerabilities across multiple components.

Goal Reached Thanks to every supporter — we hit 100%!

visionOS 26.3 Security Update: dyld RCE, Kernel Privilege Escalation CVEs