Apple patches dyld flaw linked to targeted attacks

Apple released iOS 26.3 and iPadOS 26.3 on 11 February with a fix for CVE-2026-20700 in dyld. The security bulletin says an attacker who already had memory write capability could potentially execute arbitrary code.

Apple said it was aware of a report that the flaw may have been exploited in a sophisticated attack against specific targeted individuals using versions of iOS before iOS 26. That qualification matters: the notice does not describe a widespread campaign, name victims or identify the attacker.

The company addressed the memory corruption issue through improved state management and credited Google’s Threat Analysis Group. It also said CVE-2025-14174 and CVE-2025-43529 had been issued in response to the same report.

The iOS and iPadOS release covered supported devices beginning with iPhone 11 and specified iPad generations. Apple’s bulletin separates the exploitation report from the general availability of the patch; the release date is not the date the attacks began. It records the availability of remediation.