CVE-2026-20673

CVSS 5.3 MEDIUMEPSS 0.3%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Feb 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. Turning off "Load remote content in messages” may not apply to all mail previews.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Apple · iOS and iPadOS Apple · macOS

References

https://support.apple.com/en-us/126347 https://support.apple.com/en-us/126348 https://support.apple.com/en-us/126349 https://support.apple.com/en-us/126350