Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "Visionos",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-02-11-2026-8 visionOS 26.3\n\nvisionOS 26.3 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126353.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAppleMobileFileIntegrity\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20625: Mickey Jin (@patch1t), Ryan Dowd (@_rdowd)\n\nBluetooth\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Bluetooth packets\nDescription: A denial-of-service issue was addressed with improved\nvalidation.\nCVE-2026-20650: jioundai\n\nCFNetwork\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote user may be able to write arbitrary files\nDescription: A path handling issue was addressed with improved logic.\nCVE-2026-20660: Amy (amys.website)\n\nCoreAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20611: Anonymous working with Trend Micro Zero Day Initiative\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice or potentially disclose memory contents\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20609: Yiğit Can YILMAZ (@yilmazcanyigit)\n\nCoreServices\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to gain root privileges\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-20617: Gergely Kalman (@gergely_kalman), Csaba Fitzl\n(@theevilbit) of Iru\n\nCoreServices\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to gain root privileges\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20615: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman\n(@gergely_kalman)\n\nCoreServices\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: An issue existed in the handling of environment variables.\nThis issue was addressed with improved validation.\nCVE-2026-20627: an anonymous researcher\n\ndyld\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker with memory write capability may be able to execute\narbitrary code. Apple is aware of a report that this issue may have been\nexploited in an extremely sophisticated attack against specific targeted\nindividuals on versions of iOS before iOS 26. CVE-2025-14174 and\nCVE-2025-43529 were also issued in response to this report.\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nCVE-2026-20700: Google Threat Analysis Group\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to disclosure of\nuser information\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-20675: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20634: George Karchemsky (@gkarchemsky) working with Trend\nMicro Zero Day Initiative\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20654: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious app may be able to gain root privileges\nDescription: This issue was addressed with improved checks.\nCVE-2026-20626: Keisuke Hosoda\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-20671: Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian,\nZhaowei Tan, Srikanth V. Krishnamurthy, Mathy Vanhoef\n\nlibexpat\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to a denial-of-\nservice\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-59375\n\nMessages\nAvailable for: Apple Vision Pro (all models)\nImpact: A shortcut may be able to bypass sandbox restrictions\nDescription: A race condition was addressed with improved handling of\nsymbolic links.\nCVE-2026-20677: Ron Masas of BreakPoint.SH\n\nModel I/O\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted USD file may lead to unexpected\napp termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-20616: Michael DePlante (@izobashi) of Trend Micro Zero Day\nInitiative\n\nSandbox\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to break out of its sandbox\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-20628: Noah Gregory (wts.dev)\n\nShortcuts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-20653: Enis Maholli (enismaholli.com)\n\nStoreKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to identify what other apps a user has\ninstalled\nDescription: A privacy issue was addressed with improved checks.\nCVE-2026-20641: Gongyu Ma (@Mezone0)\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 303959\nCVE-2026-20652: Nathaniel Oh (@calysteon)\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 303357\nCVE-2026-20608: HanQing from TSDubhe and Nan Wang (@eternalsakura13)\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A website may be able to track users through Safari web\nextensions\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 305020\nCVE-2026-20676: Tom Van Goethem\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 303444\nCVE-2026-20644: HanQing from TSDubhe and Nan Wang (@eternalsakura13)\nWebKit Bugzilla: 304657\nCVE-2026-20636: EntryHi\nWebKit Bugzilla: 304661\nCVE-2026-20635: EntryHi\n\nWi-Fi\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20621: Wang Yu of Cyberserval\n\nAdditional recognition\n\nBluetooth\nWe would like to acknowledge Tommaso Sacchetti for their assistance.\n\nKernel\nWe would like to acknowledge Joseph Ravichandran (@0xjprx) of MIT CSAIL,\nXinru Chi of Pangu Lab for their assistance.\n\nlibpthread\nWe would like to acknowledge Fabiano Anemone for their assistance.\n\nNetworkExtension\nWe would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.\n\nShortcuts\nWe would like to acknowledge Robert Reichel for their assistance.\n\nTransparency\nWe would like to acknowledge Wojciech Regula of SecuRing\n(wojciechregula.blog) for their assistance.\n\nWallet\nWe would like to acknowledge Lorenzo Santina (@BigNerd95) and Marco\nBartoli (@wsxarcher) for their assistance.\n\nWebKit\nWe would like to acknowledge David Wood, EntryHi, Luigino Camastra of\nAisle Research, Stanislav Fort of Aisle Research, Vsevolod Kokorin\n(Slonser) of Solidlab and Jorian Woltjer for their assistance.\n\nInstructions on how to update visionOS are available\nat https://support.apple.com/kb/HT214009\n\nTo check the software version on your Apple Vision Pro,\nopen the Settings app and choose General > About.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple's Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmmND6oACgkQ4Ifiq8DH\n7PXPBA/+K5T2rxGaUW4+gND03ycy2BbcYToRA13LlW0AOT1hiQKedzOHevc9gQlZ\nvzgXXVQMXBvVN1QOOqhXcbx+ioQFnXGSLu4QqmYAo1Fam4TrlDRgmX0jryQnXPkV\nj6CU9z0oaxDwVe9cZmepgHzisbjby7NzZ8muUxWle6buXzEcMLgYStKGkjzxxPzI\nKn51mExzFbjcv6UFy65z/ZRtTirjTzh7npYoHI42NSRXlWNEGX9DIgjtvVp4BEiP\nH4gRVUtBl9woB7S20eTmzUVviDo10v4t/zyKXtwGmwewLlSabzHHniU4S6e6hzYu\ntq9hpEkEKSMe0MxNbiUY8qB0KHW/R6MiU9us2VJJk8UQGJNgDKGBPTHdUwjSjndp\nthkEevim1egql6I7lSQTeRnPRQ0kfHPlmNkbycFd+K+z4BbuAgKKwvy19/QDBuSL\n7V1mNUSg4QKWXjzho9BMKo4KixnGXSglusaZe42hxodUexTHswoAjxfAe9Ed/2M1\nymbXCQt8i9Jcygtw8MsHagVw5ceZTLoGL5gXeuxK+FWsoLrs5U6abDuYCAHg72xk\nBKzKGMilkrEREMWF1ttBhRXjO0Vyc033+gXyeIGqFv1BzF7K+T0rdsPxO0sZ9iGx\n2/7D7oVjVYQjOmLVOdqyC7A1xEBRkKN3XFzd1qXZ2RWXXhjw7ac=\n=2V6r\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:11:50Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/28"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/28"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126353"
},
{
"url": "https://support.apple.com/kb/HT214009"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/28"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-02-11-2026-8 visionOS 26.3",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-14174",
"type": "related"
},
{
"destId": "CVE-2025-43529",
"type": "related"
},
{
"destId": "CVE-2025-59375",
"type": "related"
},
{
"destId": "CVE-2026-20608",
"type": "related"
},
{
"destId": "CVE-2026-20609",
"type": "related"
},
{
"destId": "CVE-2026-20611",
"type": "related"
},
{
"destId": "CVE-2026-20615",
"type": "related"
},
{
"destId": "CVE-2026-20616",
"type": "related"
},
{
"destId": "CVE-2026-20617",
"type": "related"
},
{
"destId": "CVE-2026-20621",
"type": "related"
},
{
"destId": "CVE-2026-20625",
"type": "related"
},
{
"destId": "CVE-2026-20626",
"type": "related"
},
{
"destId": "CVE-2026-20627",
"type": "related"
},
{
"destId": "CVE-2026-20628",
"type": "related"
},
{
"destId": "CVE-2026-20634",
"type": "related"
},
{
"destId": "CVE-2026-20635",
"type": "related"
},
{
"destId": "CVE-2026-20636",
"type": "related"
},
{
"destId": "CVE-2026-20641",
"type": "related"
},
{
"destId": "CVE-2026-20644",
"type": "related"
},
{
"destId": "CVE-2026-20650",
"type": "related"
},
{
"destId": "CVE-2026-20652",
"type": "related"
},
{
"destId": "CVE-2026-20653",
"type": "related"
},
{
"destId": "CVE-2026-20654",
"type": "related"
},
{
"destId": "CVE-2026-20660",
"type": "related"
},
{
"destId": "CVE-2026-20671",
"type": "related"
},
{
"destId": "CVE-2026-20675",
"type": "related"
},
{
"destId": "CVE-2026-20676",
"type": "related"
},
{
"destId": "CVE-2026-20677",
"type": "related"
},
{
"destId": "CVE-2026-20700",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0223",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/28",
"automated": true,
"contentSha256": "762275aa0c0a03625be3e5807a66f4c70b94cb81e01e992f4a8c904606d2cde6",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/28",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-12T00:06:22Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:43Z",
"dateUpdated": "2026-09-11T11:11:50Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0223"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}