CVE-2020-27930KEV · OVERDUE

Apple Multiple Products Memory Corruption Vulnerability

High · published December 8, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 97.7th percentile for exploit probability.

1635
days past CISA
deadline
CVSS v3.1
7.8
EPSS
22%
Percentile
97.7
In the wild
Confirmed
What it is

⚡ Just one maliciously crafted font is all it takes for this memory corruption issue to lead to arbitrary code execution—essentially opening a backdoor to your device! 🔥 Think of it like a sneaky restaurant server who delivers a poisoned dessert—once it's in your system, there's no telling what kind of chaos it could cause! 🍰 This vulnerability could allow an attacker to execute arbitrary code on your device, potentially leading to unauthorized access, data theft, or complete control over your system. The consequences of such an exploit could be absolutely devastating, turning your trusted device into a playground for attackers!

Put simply

Think of it like a sneaky restaurant server who delivers a poisoned dessert—once it's in your system, there's no telling what kind of chaos it could cause! 🍰 CVE-2020-27930 pertains to a memory corruption issue that arises when processing certain maliciously crafted fonts, allowing attackers to manipulate system memory and execute arbitrary code.

What to do

This vulnerability could allow an attacker to execute arbitrary code on your device, potentially leading to unauthorized access, data theft, or complete control over your system. The consequences of such an exploit could be absolutely devastating, turning your trusted device into a playground for attackers! To protect yourself, update to macOS Big Sur 11.0.1, iOS 14.2, or the latest versions for other affected operating systems. Ensuring your devices are always running the latest security updates is crucial for preventing such exploits! 🛡️ You've got this! Stay vigilant, follow these steps, and your devices will be safe in no time! 🚀

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.22009 · 97.7th percentile
Published
2020-12-08T20:17Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 08 DEC 20:17Z
    A memory corruption issue was addressed with improved input validation
    cvelistv5