Protection Mechanism Failure in macOS - CVE-2026-20673
Published: February 11, 2026
Vulnerability identifier: #VU122711
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20673
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in Mail. Turning off the "Load remote content in messages" may not apply to all mail previews, leading to information exposure.
Affected software
macOS
iPadOS
Apple iOS
iPadOS
Apple iOS
How to mitigate CVE-2026-20673
Install updates from vendor's website.
macOS - addressed in versions 26.3 25D125, 14.8.4 23J319, 15.7.4 24G517
iPadOS - update to 18.7.5 22H311
Apple iOS - update to 18.7.5 22H311
iPadOS - update to 18.7.5 22H311
Apple iOS - update to 18.7.5 22H311