{"metadata": {"vulnerability": "CVE-2026-20637", "count": 66, "kinds": {"milestone": 14, "sighting": 10, "kev": 0, "other": 42}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0102", "record": "NCSC-2026-0102", "field": "document.tracking.generator.date"}, {"timestamp": "2025-11-11T14:43:07.861Z", "date_only": false, "value": "2025-11-11T14:43:07.861Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-20637", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-02-11T23:00:00Z", "date_only": false, "value": "2026-02-11T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0402", "record": "WID-SEC-W-2026-0402", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-02-11T23:00:00Z", "date_only": false, "value": "2026-02-11T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0403", "record": "WID-SEC-W-2026-0403", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-02-11T23:00:00Z", "date_only": false, "value": "2026-02-11T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0402", "record": "WID-SEC-W-2026-0402", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-02-11T23:00:00Z", "date_only": false, "value": "2026-02-11T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0403", "record": "WID-SEC-W-2026-0403", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-02-11T23:00:00Z", "date_only": false, "value": "2026-02-11T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0402", "record": "WID-SEC-W-2026-0402", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-02-11T23:00:00Z", "date_only": false, "value": "2026-02-11T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0403", "record": "WID-SEC-W-2026-0403", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-03-24T00:00:00Z", "date_only": true, "value": "2026-03-24", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0355", "record": "CERTFR-2026-AVI-0355", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0402", "record": "WID-SEC-W-2026-0402", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0403", "record": "WID-SEC-W-2026-0403", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0852", "record": "WID-SEC-W-2026-0852", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0853", "record": "WID-SEC-W-2026-0853", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0852", "record": "WID-SEC-W-2026-0852", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0853", "record": "WID-SEC-W-2026-0853", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0852", "record": "WID-SEC-W-2026-0852", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0853", "record": "WID-SEC-W-2026-0853", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0402", "record": "WID-SEC-W-2026-0402", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-03-24T23:00:00Z", "date_only": false, "value": "2026-03-24T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0403", "record": "WID-SEC-W-2026-0403", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-03-25T00:00:00Z", "date_only": false, "value": "2026-03-25T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0355", "record": "CERTFR-2026-AVI-0355", "field": "last_revision_date"}, {"timestamp": "2026-03-25T00:00:00Z", "date_only": false, "value": "2026-03-25T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0355", "record": "CERTFR-2026-AVI-0355", "field": "initial_release_date"}, {"timestamp": "2026-03-25T00:00:00Z", "date_only": false, "value": "2026-03-25T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0355", "record": "CERTFR-2026-AVI-0355", "field": "revisions.0.revision_date"}, {"timestamp": "2026-03-25T00:01:12Z", "date_only": false, "value": "2026-03-25T00:01:12Z", "kind": "other", "label": "Source Published At", "source": "gna-1988 \u00b7 GCVE-1988-2026-0262 / VULNARCHIVE", "record": "GCVE-1988-2026-0262", "field": "containers.cna.x_gcve.0.x_vulnarchive.sourcePublishedAt"}, {"timestamp": "2026-03-25T00:02:26Z", "date_only": false, "value": "2026-03-25T00:02:26Z", "kind": "other", "label": "Source Published At", "source": "gna-1988 \u00b7 GCVE-1988-2026-0264 / VULNARCHIVE", "record": "GCVE-1988-2026-0264", "field": "containers.cna.x_gcve.0.x_vulnarchive.sourcePublishedAt"}, {"timestamp": "2026-03-25T00:02:51Z", "date_only": false, "value": "2026-03-25T00:02:51Z", "kind": "other", "label": "Source Published At", "source": "gna-1988 \u00b7 GCVE-1988-2026-0265 / VULNARCHIVE", "record": "GCVE-1988-2026-0265", "field": "containers.cna.x_gcve.0.x_vulnarchive.sourcePublishedAt"}, {"timestamp": "2026-03-25T00:32:10.184Z", "date_only": false, "value": "2026-03-25T00:32:10.184Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-20637", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-03-25T01:17:04Z", "date_only": false, "value": "2026-03-25T01:17:04Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QMPR-R5H7-6C7X", "record": "GHSA-QMPR-R5H7-6C7X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-03-25T01:17:04.310Z", "date_only": false, "value": "2026-03-25T01:17:04.310", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20637", "record": "FKIE_CVE-2026-20637", "field": "published"}, {"timestamp": "2026-03-25T03:31:29Z", "date_only": false, "value": "2026-03-25T03:31:29Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QMPR-R5H7-6C7X", "record": "GHSA-QMPR-R5H7-6C7X", "field": "published"}, {"timestamp": "2026-03-25T06:11:04.490Z", "date_only": false, "value": "2026-03-25T06:11:04.490+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0402", "record": "WID-SEC-W-2026-0402", "field": "document.tracking.generator.date"}, {"timestamp": "2026-03-25T06:16:06.862Z", "date_only": false, "value": "2026-03-25T06:16:06.862+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0403", "record": "WID-SEC-W-2026-0403", "field": "document.tracking.generator.date"}, {"timestamp": "2026-03-25T14:15:56.073Z", "date_only": false, "value": "2026-03-25T14:15:56.073353Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0102", "record": "NCSC-2026-0102", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-03-25T14:15:56.073Z", "date_only": false, "value": "2026-03-25T14:15:56.073353Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0102", "record": "NCSC-2026-0102", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-03-25T14:15:56.073Z", "date_only": false, "value": "2026-03-25T14:15:56.073353Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0102", "record": "NCSC-2026-0102", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-03-25T15:48:17.344Z", "date_only": false, "value": "2026-03-25T15:48:17.344532Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-20637", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-03-25T15:48:17.344Z", "date_only": false, "value": "2026-03-25T15:48:17.344532Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20637", "record": "FKIE_CVE-2026-20637", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-03-25T15:48:41.578Z", "date_only": false, "value": "2026-03-25T15:48:41.578Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-20637", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-03-25T18:31:40Z", "date_only": false, "value": "2026-03-25T18:31:40Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QMPR-R5H7-6C7X", "record": "GHSA-QMPR-R5H7-6C7X", "field": "modified"}, {"timestamp": "2026-03-26T03:00:12Z", "date_only": false, "value": "2026-03-26T03:00:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://support.apple.com/en-us/126795", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "0fe1144c-76a6-4507-8bc5-e11398a32a12", "url": "https://support.apple.com/en-us/126795"}, {"timestamp": "2026-03-26T03:00:13Z", "date_only": false, "value": "2026-03-26T03:00:13.000000Z", "kind": "sighting", "label": "Seen", "source": "https://support.apple.com/en-us/126796", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "0b3575b8-d7c6-4a7b-96db-ff0fbbbf55f4", "url": "https://support.apple.com/en-us/126796"}, {"timestamp": "2026-04-22T21:00:04Z", "date_only": false, "value": "2026-04-22T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/vKt1e4azT5T7C0rLcqmSzR1-eYk4psQyeIQOy05R--Qw2SA", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "db9a03b7-65de-47b3-aa58-6657281a5ce9"}, {"timestamp": "2026-04-23T03:00:06Z", "date_only": false, "value": "2026-04-23T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/dzDW2h-886XV-6aRi3WJqtQJrVieQigoxoc1-2T9QA1v8VU", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "7ef1f267-d950-47b3-a941-eba78bbe8b7b"}, {"timestamp": "2026-05-11T22:00:00Z", "date_only": false, "value": "2026-05-11T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0852", "record": "WID-SEC-W-2026-0852", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-05-11T22:00:00Z", "date_only": false, "value": "2026-05-11T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0853", "record": "WID-SEC-W-2026-0853", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-05-11T22:00:00Z", "date_only": false, "value": "2026-05-11T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0852", "record": "WID-SEC-W-2026-0852", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-05-11T22:00:00Z", "date_only": false, "value": "2026-05-11T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0853", "record": "WID-SEC-W-2026-0853", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-05-12T09:25:55.502Z", "date_only": false, "value": "2026-05-12T09:25:55.502+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0852", "record": "WID-SEC-W-2026-0852", "field": "document.tracking.generator.date"}, {"timestamp": "2026-05-12T09:25:55.946Z", "date_only": false, "value": "2026-05-12T09:25:55.946+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0853", "record": "WID-SEC-W-2026-0853", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-17T10:17:35.117Z", "date_only": false, "value": "2026-06-17T10:17:35.117", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20637", "record": "FKIE_CVE-2026-20637", "field": "lastModified"}, {"timestamp": "2026-07-13T13:00:04.683Z", "date_only": false, "value": "2026-07-13T13:00:04.683991Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/6188", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "202ab43e-0c6a-474c-8be6-e0cbc5939fee", "content": "zeroxjf \u2014 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439, \u043d\u043e \u043f\u043b\u043e\u0442\u043d\u044b\u0439 \u0431\u043b\u043e\u0433 \u043f\u0440\u043e iOS security research: \u044f\u0434\u0440\u043e, SEP, IOKit, jailbreak/tweak-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0440\u0435\u0432\u0435\u0440\u0441-\u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044e\n\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043a\u0430\u043a \u0438\u043d\u0434\u0435\u043a\u0441 \u0440\u0430\u0431\u043e\u0442: \u0440\u044f\u0434\u043e\u043c \u043b\u0435\u0436\u0430\u0442 PoC \u0434\u043b\u044f Apple kernel/SEP \u0431\u0430\u0433\u043e\u0432, \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u043f\u043e Cyanide \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 Metal \u0432 vphone. \u041c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b \u043f\u043e\u043b\u0435\u0437\u043d\u044b \u0442\u0435\u043c, \u043a\u0442\u043e \u0445\u043e\u0447\u0435\u0442 \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0438\u0442\u043e\u0433\u043e\u0432\u044b\u0439 CVE, \u0430 \u043d\u0430 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u0440\u0435\u0441\u0435\u0440\u0447\u0430, race window, panic signature, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f.\n\n\u0422\u043e\u043f-5 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432:\n\n1. CVE-2026-20637: AppleSEPKeyStore Use-After-Free \u2014 UAF \u0432 AppleKeyStore/AppleSEPKeyStore \u0447\u0435\u0440\u0435\u0437 \u0433\u043e\u043d\u043a\u0443 \u043c\u0435\u0436\u0434\u0443 IOConnectCallMethod \u0438 IOServiceClose; \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 iOS/macOS 26.1-26.2, \u043f\u0430\u0442\u0447 \u0437\u0430\u044f\u0432\u043b\u0435\u043d \u0432 iOS/iPadOS 26.3.\n2. SEP Exhaustion Kernel Panic \u2014 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 SEP firmware panic \u0447\u0435\u0440\u0435\u0437 AppleKeyStore selector 2 \u0438 open type 0x2022; \u043e\u043a\u043e\u043b\u043e 41 \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 crash signature \u0432 SKS.\n3. CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF \u2014 deferred kernel panic \u0432 AppleJPEGDriver: async decode \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 stale queue node, \u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 sync decode \u0447\u0435\u0440\u0435\u0437 Camera \u0434\u043e\u0431\u0438\u0432\u0430\u0435\u0442 UAF \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438.\n4. Cyanide: Writing Tweaks \u2014 developer reference \u043f\u043e Cyanide tweaks: RemoteCall-\u0441\u0435\u0441\u0441\u0438\u0438, remote_objc API, \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 tweak, Settings-\u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0438 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 Theos/Substrate \u0431\u0435\u0437 SpringBoard dylib-\u0445\u0443\u043a\u043e\u0432.\n5. Patching Metal Graphics into vphone \u2014 clean-room shim \u0434\u043b\u044f Metal compiler plugin \u0432 vphone: \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PCC dyld shared cache \u0438 \u0441\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 relocations, \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u2014 ~230 \u0441\u0442\u0440\u043e\u043a C++ \u0441 runtime symbol resolution.\n\n\u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0435\u0441\u044c \u0441\u0435\u0441\u0443\u0440\u0438\u0442\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u043c \u044f\u0434\u0440\u0430 iOS \u0438\u043b\u0438 \u0445\u043e\u0442\u0438\u0442\u0435 \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0430\u043a \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0435 \u0431\u0430\u0433\u0438 \u0432\u043e\u043a\u0440\u0443\u0433 IOKit/SEP, zeroxjf \u0441\u0442\u043e\u0438\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432 \u0437\u0430\u043a\u043b\u0430\u0434\u043a\u0438: \u0442\u0443\u0442 \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0447\u0442\u043e \u0432\u0441\u0451 \u043d\u0443\u0436\u043d\u043e\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0438 \u0441\u0440\u0430\u0437\u0443.\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "url": "https://t.me/poxek/6188"}, {"timestamp": "2026-07-13T22:00:17.571Z", "date_only": false, "value": "2026-07-13T22:00:17.571466Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/91042", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "70c2a895-83ad-4236-a8e3-59ba28e02ea8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20637-AppleSEPKeyStore-UAF\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zeroxjf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Objective-C\n\u2b50 Star\u6570\u91cf\uff1a 54  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 7\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-28 22:18:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20637: AppleSEPKeyStore Use-After-Free \u2014 iOS/macOS kernel vulnerability (patched in 26.4)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/91042"}, {"timestamp": "2026-07-14T00:00:48.076Z", "date_only": false, "value": "2026-07-14T00:00:48.076803Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/6188", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "47af7097-f131-4cfc-ae25-10ca1ebdaa82", "content": "zeroxjf \u2014 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439, \u043d\u043e \u043f\u043b\u043e\u0442\u043d\u044b\u0439 \u0431\u043b\u043e\u0433 \u043f\u0440\u043e iOS security research: \u044f\u0434\u0440\u043e, SEP, IOKit, jailbreak/tweak-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0440\u0435\u0432\u0435\u0440\u0441-\u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044e\n\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043a\u0430\u043a \u0438\u043d\u0434\u0435\u043a\u0441 \u0440\u0430\u0431\u043e\u0442: \u0440\u044f\u0434\u043e\u043c \u043b\u0435\u0436\u0430\u0442 PoC \u0434\u043b\u044f Apple kernel/SEP \u0431\u0430\u0433\u043e\u0432, \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u043f\u043e Cyanide \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 Metal \u0432 vphone. \u041c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b \u043f\u043e\u043b\u0435\u0437\u043d\u044b \u0442\u0435\u043c, \u043a\u0442\u043e \u0445\u043e\u0447\u0435\u0442 \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0438\u0442\u043e\u0433\u043e\u0432\u044b\u0439 CVE, \u0430 \u043d\u0430 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u0440\u0435\u0441\u0435\u0440\u0447\u0430, race window, panic signature, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f.\n\n\u0422\u043e\u043f-5 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432:\n\n1. CVE-2026-20637: AppleSEPKeyStore Use-After-Free \u2014 UAF \u0432 AppleKeyStore/AppleSEPKeyStore \u0447\u0435\u0440\u0435\u0437 \u0433\u043e\u043d\u043a\u0443 \u043c\u0435\u0436\u0434\u0443 IOConnectCallMethod \u0438 IOServiceClose; \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 iOS/macOS 26.1-26.2, \u043f\u0430\u0442\u0447 \u0437\u0430\u044f\u0432\u043b\u0435\u043d \u0432 iOS/iPadOS 26.3.\n2. SEP Exhaustion Kernel Panic \u2014 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 SEP firmware panic \u0447\u0435\u0440\u0435\u0437 AppleKeyStore selector 2 \u0438 open type 0x2022; \u043e\u043a\u043e\u043b\u043e 41 \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 crash signature \u0432 SKS.\n3. CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF \u2014 deferred kernel panic \u0432 AppleJPEGDriver: async decode \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 stale queue node, \u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 sync decode \u0447\u0435\u0440\u0435\u0437 Camera \u0434\u043e\u0431\u0438\u0432\u0430\u0435\u0442 UAF \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438.\n4. Cyanide: Writing Tweaks \u2014 developer reference \u043f\u043e Cyanide tweaks: RemoteCall-\u0441\u0435\u0441\u0441\u0438\u0438, remote_objc API, \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 tweak, Settings-\u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0438 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 Theos/Substrate \u0431\u0435\u0437 SpringBoard dylib-\u0445\u0443\u043a\u043e\u0432.\n5. Patching Metal Graphics into vphone \u2014 clean-room shim \u0434\u043b\u044f Metal compiler plugin \u0432 vphone: \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PCC dyld shared cache \u0438 \u0441\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 relocations, \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u2014 ~230 \u0441\u0442\u0440\u043e\u043a C++ \u0441 runtime symbol resolution.\n\n\u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0435\u0441\u044c \u0441\u0435\u0441\u0443\u0440\u0438\u0442\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u043c \u044f\u0434\u0440\u0430 iOS \u0438\u043b\u0438 \u0445\u043e\u0442\u0438\u0442\u0435 \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0430\u043a \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0435 \u0431\u0430\u0433\u0438 \u0432\u043e\u043a\u0440\u0443\u0433 IOKit/SEP, zeroxjf \u0441\u0442\u043e\u0438\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432 \u0437\u0430\u043a\u043b\u0430\u0434\u043a\u0438: \u0442\u0443\u0442 \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0447\u0442\u043e \u0432\u0441\u0451 \u043d\u0443\u0436\u043d\u043e\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0438 \u0441\u0440\u0430\u0437\u0443.\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "url": "https://t.me/poxek/6188"}, {"timestamp": "2026-07-15T00:00:23.766Z", "date_only": false, "value": "2026-07-15T00:00:23.766021Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/91042", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "6c12b8cb-2eee-47d8-a749-577bb879377f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20637-AppleSEPKeyStore-UAF\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zeroxjf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Objective-C\n\u2b50 Star\u6570\u91cf\uff1a 54  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 7\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-28 22:18:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20637: AppleSEPKeyStore Use-After-Free \u2014 iOS/macOS kernel vulnerability (patched in 26.4)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/91042"}, {"timestamp": "2026-08-17T21:30:26.886Z", "date_only": false, "value": "2026-08-17T21:30:26.886Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-20637", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-17T21:30:26.886Z", "date_only": false, "value": "2026-08-17T21:30:26.886Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apple", "record": "CVE-2026-20637", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-07T12:00:03.591Z", "date_only": false, "value": "2026-09-07T12:00:03.591958Z", "kind": "sighting", "label": "Seen", "source": "Telegram/m8SWfVeZlticuBT317GgsGZAEtL8zbxvMheXkcIiGwkXhdo", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "018c1c70-7757-4a60-a0b5-e07165f0da00"}, {"timestamp": "2026-09-08T00:00:45.763Z", "date_only": false, "value": "2026-09-08T00:00:45.763488Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/m8SWfVeZlticuBT317GgsGZAEtL8zbxvMheXkcIiGwkXhdo", "record": "CVE-2026-20637", "field": "creation_timestamp", "uuid": "da05003d-58b2-4f44-82b2-c881274810ff"}, {"timestamp": "2026-09-08T08:13:42Z", "date_only": false, "value": "2026-09-08T08:13:42Z", "kind": "milestone", "label": "Published", "source": "gna-1988 \u00b7 GCVE-1988-2026-0262", "record": "GCVE-1988-2026-0262", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-08T08:13:43Z", "date_only": false, "value": "2026-09-08T08:13:43Z", "kind": "milestone", "label": "Published", "source": "gna-1988 \u00b7 GCVE-1988-2026-0264", "record": "GCVE-1988-2026-0264", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-08T08:13:43Z", "date_only": false, "value": "2026-09-08T08:13:43Z", "kind": "milestone", "label": "Published", "source": "gna-1988 \u00b7 GCVE-1988-2026-0265", "record": "GCVE-1988-2026-0265", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-09T10:08:25Z", "date_only": false, "value": "2026-09-09T10:08:25Z", "kind": "other", "label": "Updated", "source": "gna-1988 \u00b7 GCVE-1988-2026-0262", "record": "GCVE-1988-2026-0262", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-09T10:08:25Z", "date_only": false, "value": "2026-09-09T10:08:25Z", "kind": "other", "label": "Updated", "source": "gna-1988 \u00b7 GCVE-1988-2026-0262 / VULNARCHIVE", "record": "GCVE-1988-2026-0262", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-11T11:21:40Z", "date_only": false, "value": "2026-09-11T11:21:40Z", "kind": "other", "label": "Updated", "source": "gna-1988 \u00b7 GCVE-1988-2026-0264", "record": "GCVE-1988-2026-0264", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-11T11:21:40Z", "date_only": false, "value": "2026-09-11T11:21:40Z", "kind": "other", "label": "Updated", "source": "gna-1988 \u00b7 GCVE-1988-2026-0264 / VULNARCHIVE", "record": "GCVE-1988-2026-0264", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-11T11:21:42Z", "date_only": false, "value": "2026-09-11T11:21:42Z", "kind": "other", "label": "Updated", "source": "gna-1988 \u00b7 GCVE-1988-2026-0265", "record": "GCVE-1988-2026-0265", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-11T11:21:42Z", "date_only": false, "value": "2026-09-11T11:21:42Z", "kind": "other", "label": "Updated", "source": "gna-1988 \u00b7 GCVE-1988-2026-0265 / VULNARCHIVE", "record": "GCVE-1988-2026-0265", "field": "containers.cna.providerMetadata.dateUpdated"}]}