Critical Apple Flaw Exploited in 'Sophisticated' Attacks, Company Urges Rapid Patching

"The vulnerability is tracked as CVE-2026-20700. It affects dyld, which is Apple's Dynamic Link Editor. Dyld is a core component responsible for loading and linking executable code across iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. Because dyld operates at a foundational level within the operating system, a flaw in this component carries significant risk. Apple classified the issue as an arbitrary code-execution vulnerability and warned that an attacker with memory-write capability could exploit it to run malicious code on an affected device."

"In practical terms, successful exploitation could allow threat actors to execute payloads with elevated privileges, potentially enabling spyware deployment, data theft, or further privilege escalation as part of a broader attack chain. Apple confirmed that CVE-2026-20700 was exploited in the same incidents as two previously patched vulnerabilities, CVE-2025-14174 and CVE-2025-43529, suggesting the possibility of exploit chaining. The company also confirmed that all three CVEs were exploited in targeted attacks, but did not elaborate on who was targeted or how they were chained together."

"Apple is urging users to update their devices immediately after patching a zero-day vulnerability that was exploited in what it described as "extremely sophisticated" attacks against specific individuals. The flaw, which impacts multiple Apple operating systems, allowed attackers to execute arbitrary code on vulnerable devices. "An attacker with memory write capability may be able to execute arbitrary code," Apple said in its security advisory."

Dyld (Apple's Dynamic Link Editor) contains a zero-day tracked as CVE-2026-20700 that permits arbitrary code execution when an attacker has memory-write capability. The flaw affects iOS, iPadOS, macOS, tvOS, watchOS, and visionOS on many recent iPhone, iPad, and Mac models. Dyld operates at a foundational level within the operating system, increasing the severity of any flaw in that component. Successful exploitation can let attackers execute payloads with elevated privileges, enabling spyware deployment, data theft, or privilege escalation. Apple confirmed CVE-2026-20700 was exploited alongside CVE-2025-14174 and CVE-2025-43529 in targeted incidents, indicating possible exploit chaining. Immediate installation of security updates removes the vulnerability and reduces exposure.

Read at TechRepublic