CVE-2026-20494
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the Wi-Fi module, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
Risk Assessment
The risk involves potential leakage of sensitive data from system memory, which could compromise information security within the organization.
Recommendation
It is recommended to immediately apply the patches referenced by IDs ALPS10960006, BORA00155314, BORA00155001, BORA00154907.
Other vulnerabilities in Wi-Fi
See all- CVE-2017-7116High
An issue was discovered in certain Apple products, including iOS before 11, tvOS before 11, and watchOS before 4, related to the 'Wi-Fi' component. This issue might allow remote attackers to read data from kernel memory locations via crafted Wi-Fi traffic.
- CVE-2017-7115High
An issue was discovered in certain Apple products, including iOS before 11 and tvOS before 11, related to the 'Wi-Fi' component. It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic that leverages a race condition.
- CVE-2017-7112Critical
An issue was discovered in certain Apple products, including iOS before 11, tvOS before 11, and watchOS before 4, related to the 'Wi-Fi' component. It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic.
- CVE-2017-7110Critical
An issue was discovered in certain Apple products, including iOS, tvOS, and watchOS, related to the 'Wi-Fi' component. It may allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service through crafted Wi-Fi traffic.
- CVE-2017-7108Critical
An issue was discovered in certain Apple products related to the 'Wi-Fi' component. iOS, tvOS, and watchOS versions before 11, 11, and 4 respectively are vulnerable to attacks that may allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service via crafted Wi-Fi traffic.
- CVE-2017-7105Critical
An issue was discovered in certain Apple products, including iOS before 11, tvOS before 11, and watchOS before 4, related to the 'Wi-Fi' component. It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic.
- CVE-2017-7103Critical
An issue was discovered in certain Apple products related to the 'Wi-Fi' component. iOS versions before 11, tvOS before 11, and watchOS before 4 are vulnerable to attacks that may allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service via crafted Wi-Fi traffic.
- CVE-2026-20493Medium
In the Wi-Fi module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained System privileges. User interaction is not required for exploitation.
Original NVD description (English source)
In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10960006 / BORA00155314, BORA00155001, BORA00154907; Issue ID: MSV-7570.