Apple fixes first exploited zero-day of 2026 in dyld component

Apple released updates across its operating systems on Feb. 11 to fix CVE-2026-20700, a memory corruption flaw in dyld, the dynamic link editor that loads apps and system libraries. Apple said it is aware of a report that the bug may have been exploited in a highly sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.

It was Apple's first confirmed zero-day patch of 2026, according to Expert Insights, after the company addressed nine actively exploited flaws in 2025.

Part of a larger exploit chain

According to Apple's security notes, an attacker who already has the ability to write to memory may be able to run arbitrary code using the flaw. That description suggests it was a later stage in an exploit chain. Apple said two bugs it patched in December 2025, CVE-2025-14174 in the ANGLE graphics layer and CVE-2025-43529 in WebKit, were issued in response to the same report. The company did not explain how the three fit together.

Google's Threat Analysis Group, which tracks government-backed hackers and commercial spyware, is credited with the discovery. Apple has not attributed the attacks.

Fixed versions

• iOS 26.3 and iPadOS 26.3 (iPhone 11 and later), plus iOS and iPadOS 18.7.5 for older devices
• macOS Tahoe 26.3, macOS Sequoia 15.7.4 and macOS Sonoma 14.8.4
• tvOS 26.3, watchOS 26.3 and visionOS 26.3

The Canadian Centre for Cyber Security issued advisory AV26-122 listing the affected products. CISA added CVE-2026-20700 to its Known Exploited Vulnerabilities catalog on Feb. 12. NVD lists a CVSS score of 7.8.

What to do

• Update iPhones and iPads through Settings, then General, then Software Update.
• Update Macs through System Settings, then General, then Software Update, and update Apple TV, Apple Watch and Vision Pro devices.
• Organizations should push the updates through their device management tools and check for devices stuck on older iOS releases.