Apple Patches Actively Exploited dyld Zero-Day in iOS and Other Platforms

Apple released security updates to address an actively exploited zero-day tracked as CVE-2026-20700, warning it may have been used in an “extremely sophisticated” attack targeting specific individuals on versions of iOS prior to iOS 26. The flaw affects dyld (Apple’s dynamic linker) and can allow arbitrary code execution when an attacker already has memory write capability; reporting attributes discovery to Google’s Threat Analysis Group and notes it may have been used as part of an exploit chain.

Apple shipped fixes across its ecosystem, including iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, watchOS 26.3, tvOS 26.3, and visionOS 26.3. The same reporting indicates Apple also issued patches tied to the broader report for CVE-2025-14174 (an out-of-bounds memory access issue in Chrome’s ANGLE graphics component on Mac) and CVE-2025-43529 (a use-after-free leading to code execution), and commentary from security practitioners emphasized that enterprise risk is driven by patch deployment speed—particularly where updates rely on end users rather than enforced device management.