# Apple Zero-Day CVE-2026-20700: Memory Corruption Enabling Arbitrary Code Execution — Google TAG-Discovered 'Extremely Sophisticated' Targeted Attack

> Apple's February 11, 2026 security updates patch CVE-2026-20700, an actively exploited zero-day memory corruption vulnerability affecting ALL Apple platforms — iOS/iPadOS 26.3, macOS Tahoe 26.3, watchOS 26.3, tvOS 26.3, and visionOS 26.3. Discovered by Google's Threat Analysis Group (TAG), Apple confirms the vulnerability was exploited in 'an extremely sophisticated attack against specific targeted individuals' running iOS versions before iOS 26, as part of a three-CVE infection chain with CVE-2025-14174 and CVE-2025-43529 (both patched in December 2025). The vulnerability enables an attacker with memory write capability to achieve arbitrary code execution — the hallmark of commercial spyware operations. Google TAG discovery attribution strongly suggests a commercial surveillance vendor (CSV) exploit chain, consistent with NSO Group Pegasus, Intellexa Predator, or similar mercenary spyware. The vulnerability class (memory corruption addressed with improved state management) indicates a use-after-free or type confusion primitive enabling kernel or process-level code execution.

- **Published:** 2026-02-12T11:54:00Z
- **Last reviewed:** 2026-02-12T11:54:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0075
- **ID:** TL-2026-0075
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20700, CVE-2025-14174, CVE-2025-43529

## Description

CVE-2026-20700 is a critical Apple zero-day vulnerability — a memory corruption issue addressed with improved state management — that grants attackers with memory write capability the ability to execute arbitrary code on affected devices. The vulnerability was discovered by Google's Threat Analysis Group (TAG), the team specifically tasked with tracking government-backed hacking and commercial surveillance vendors. Apple's advisory explicitly states awareness of exploitation 'in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26,' a phrasing Apple reserves exclusively for nation-state or commercial spyware operations.

THREE-CVE INFECTION CHAIN:
The exploitation chain combines three vulnerabilities in sequence:
1. CVE-2025-14174 — First stage (details undisclosed, patched December 2025)
2. CVE-2025-43529 — Second stage (details undisclosed, patched December 2025)
3. CVE-2026-20700 — Final stage: memory corruption → arbitrary code execution (patched February 11, 2026)

The first two chain CVEs were patched in Apple's December 2025 update, but CVE-2026-20700 remained unpatched until February 2026 — creating a multi-month window where users who applied December updates were still partially vulnerable through the third chain component. Users who did NOT update to December 2025 were vulnerable to the complete three-CVE chain.

AFFECTED PLATFORMS (ALL Apple ecosystem):
- iOS 26.3 and iPadOS 26.3 — iPhone 11+, iPad Pro 3rd gen+, iPad Air 3rd gen+, iPad 8th gen+, iPad mini 5th gen+
- iOS 18.7.5 and iPadOS 18.7.5 — iPhone XS/XR, iPad 7th gen (backported fixes, though CVE-2026-20700 specific patch is in 26.3)
- macOS Tahoe 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4
- watchOS 26.3 — Apple Watch Series 6+
- tvOS 26.3 — Apple TV HD and 4K (all models)
- visionOS 26.3 — Apple Vision Pro (all models)
- Safari 26.3 — macOS Sonoma and Sequoia

GOOGLE TAG ATTRIBUTION SIGNIFICANCE:
Google TAG discovers and reports vulnerabilities used by commercial surveillance vendors (CSVs) and government-backed threat actors. TAG's involvement in CVE-2026-20700 strongly indicates the exploit was deployed by a commercial spyware operation — consistent with vendors like NSO Group (Pegasus), Intellexa (Predator), Variston, Candiru, or similar mercenary spyware providers. Apple's 'extremely sophisticated attack against specific targeted individuals' language is the canonical indicator for targeted surveillance operations against journalists, activists, dissidents, opposition politicians, and human rights defenders.

ADDITIONAL HIGH-SEVERITY CVEs IN FEBRUARY 2026 APPLE UPDATE:
- CVE-2026-20617 — Root privilege escalation via race condition (multiple platforms)
- CVE-2026-20615 — Root privilege escalation via path handling (multiple platforms)
- CVE-2026-20626 — Malicious app root privilege escalation
- CVE-2026-20660 — Remote arbitrary file write via path handling
- CVE-2026-20667 — Sandbox escape via logic issue
- CVE-2026-20628 — Sandbox escape via permissions issue
- CVE-2026-20611 — Media file processing memory corruption (Trend Micro ZDI)
- CVE-2026-20671 — Network traffic interception via logic issue

This update represents Apple's response to an active commercial spyware campaign, with Google TAG providing the initial discovery.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1014 Rootkit
- T1070 Indicator Removal
- T1056 Input Capture
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1430 Location Tracking
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1037 Boot or Logon Initialization Scripts
- T1555 Credentials from Password Stores
- T1543 Create or Modify System Process
- T1553 Subvert Trust Controls

## Sources

- [Malwarebytes: Apple patches zero-day flaw that could let attackers take control of devices](https://www.malwarebytes.com/blog/news/2026/02/apple-patches-zero-day-flaw-that-could-let-attackers-take-control-of-devices)
- [Apple: About the security content of iOS 26.3 and iPadOS 26.3](https://support.apple.com/en-us/126346)
- [Apple: About the security content of macOS Tahoe 26.3](https://support.apple.com/en-us/126348)
- [Apple: About the security content of watchOS 26.3](https://support.apple.com/en-us/126352)
- [Apple: About the security content of tvOS 26.3](https://support.apple.com/en-us/126351)
- [Apple: About the security content of visionOS 26.3](https://support.apple.com/en-us/126353)
- [Apple: About the security content of Safari 26.3](https://support.apple.com/en-us/126354)
- [Apple Security Releases](https://support.apple.com/en-us/100100)
- [Google TAG: Commercial Surveillance Vendors — Buying Spying](https://blog.google/threat-analysis-group/commercial-surveillance-vendors-google-tag-report/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0075