Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A person with physical access to an iOS device may be able to access photos from the lock screen.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-11 | 1 | Disclosure1 |
| 2026-02-12 | 3 | Disclosure1Patch2 |
Apple paid me $1,000 for CVE-2026-20642. Thanks for the bounty! #bugbounty #securityresearch #infosec #hacker #CVE #apple #ios #togetherwehitharder #applebounty https://t.co/ACl2kn165A
Post summary
The researcher announces a $1,000 bounty from Apple for CVE‑2026‑20642, confirming the vulnerability’s disclosure but offering no technical exploitation details.
Apple’s February 11, 2026 security updates include a fix for a Photos vulnerability that could let someone with physical access to a locked iPhone or iPad view photos from the lock screen. Apple says the issue (CVE-2026-20642, credited to Dalibor Milanovic) was caused by an input validation flaw and is addressed in iOS 26.3 and iPadOS 26.3 for iPhone 11 and later and several recent iPad models. In a separate patch, Apple fixed a Safari logic issue that could allow an app to access a user’s Safari browsing history. The flaw (CVE-2026-20656, credited to Mickey Jin) was resolved with improved validation and is listed in iOS 18.7.5/iPadOS 18.7.5 for iPhone XS/XS Max/XR and iPad (7th gen), as well as Safari 26.3 on macOS Sonoma and macOS Sequoia. Users are advised to update promptly to reduce privacy risk.
Post summary
Apple released updates for CVE‑2026‑20642 and CVE‑2026‑20656, fixing input validation flaws that could let attackers view locked‑screen photos or access browsing history, and urges users to install iOS 26.3, iPadOS 26.3, or iOS 18.7.5/Safari 26.3 promptly.
CVE-2026-20642 iOS Lock Screen Photo Access Vulnerability in Versions Prior to 26.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-20642
Post summary
The text announces CVE-2026-20642, detailing a lock‑screen photo access flaw in iOS versions before 26.3, with no information on PoC, exploitation, patches, or active use.
CVE-2026-20642 An input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A person with physical access to an iOS device may be able to access photos … https://www.cve.org/CVERecord?id=CVE-2026-20642
Post summary
The text announces that CVE‑2026‑20642, an input‑validation flaw permitting physical access to photos, has been fixed in iOS 26.3 and iPadOS 26.3.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | apple | ipados | - | - | - |
| OS | apple | iphone_os | - | - | - |