---
id: CVE-2026-20677
title: A race condition was addressed with improved handling of symbolic links
summary: >-
  A race condition was addressed with improved handling of symbolic links. This
  issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3,
  macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. A
  shortcu…
severity: critical
cvss: 9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-362
  - CWE-367
vendor: apple
product: ipados
affected:
  - ipados < 18.7.5
  - 'ipados >= 26.0, < 26.3'
  - iphone_os < 18.7.5
  - 'iphone_os >= 26.0, < 26.3'
  - macos < 14.8.4
  - 'macos >= 26.0, < 26.3'
  - visionos < 26.3
patched:
  - ipados 26.3
  - iphone_os 26.3
  - macos 26.3
  - visionos 26.3
published: '2026-02-11'
updated: '2026-08-21'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20677'
references:
  - url: 'https://support.apple.com/en-us/126346'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/126347'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/126348'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/126349'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/126350'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/126353'
    label: product-security@apple.com
tags:
  - nvd
epss: 0.00286
epssPercentile: 0.18716
ingestedAt: '2026-08-21T03:06:25.472Z'
---

## Overview

A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. A shortcut may be able to bypass sandbox restrictions.

## Affected

- `ipados < 18.7.5`
- `ipados >= 26.0, < 26.3`
- `iphone_os < 18.7.5`
- `iphone_os >= 26.0, < 26.3`
- `macos < 14.8.4`
- `macos >= 26.0, < 26.3`
- `visionos < 26.3`

## Remediation

Upgrade past the affected range:

- `ipados 26.3`
- `iphone_os 26.3`
- `macos 26.3`
- `visionos 26.3`