- Apple patches zero-day CVE-2026-20700 in Dynamic Link Editor (dyld)
- The flaw enabled arbitrary code execution, used in sophisticated targeted attacks
- Fixes released in iOS, iPadOS, macOS, tvOS, watchOS, and visionOS updates
Apple has patched its first zero-day vulnerability in 2026, a flaw that was apparently used in an “extremely sophisticated attack”.
In a security advisory, Apple said the Google Threat Analysis Group (GTAG) discovered a memory corruption issue in the Dynamic Link Editor (dyld), a system component that helps apps run and when a person opens an app, the component loads the shared libraries it needs and links everything together.
Dyld works in the background and is essential for running apps on Apple devices.
Now Apple says the flaw, which allows malicious actors with memory-writing capabilities to execute arbitrary code on vulnerable devices, is tracked as CVE-2026-20700 and given a severity score of 9.8/10 (Critical), according to Tenable.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS prior to iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.”
Two things stand out about this guidance: that the flaw was used in an extremely sophisticated attack against specific individuals, and that it was discovered by GTAG — a group that tracks almost exclusively state-sponsored threat actors.
This could mean that the targets were politicians, diplomats, CEOs of critical infrastructure organizations or those working in the defense, aerospace or telecommunications sectors. Historically, these people are the first to be targeted with a zero-day on an Apple device.
Here is the full list of affected devices:
iPhone 11 and newer
iPad Pro 12.9″ (3rd generation and later)
iPad Pro 11-inch (1st generation and later)
iPad Air (3rd generation and later)
iPad (8th generation and later)
iPad mini (5th generation and later)
Mac devices running macOS Tahoe
The bug was fixed in iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3 and visionOS 26.3, so be sure to patch as soon as possible.
Via Bleeping Computer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
