CVE-2020-3837KEV · OVERDUE

Apple Multiple Products Memory Corruption Vulnerability

High · published February 27, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 96.7th percentile for exploit probability.

1559
days past CISA
deadline
CVSS v3.1
7.8
EPSS
15%
Percentile
96.7
In the wild
Confirmed
What it is

🚨 A memory corruption issue can let a crafty app execute arbitrary code with kernel privileges! This is a serious situation for anyone using affected Apple devices. ⚡ Think of it as a delivery service that misplaces packages, allowing unauthorized users to access confidential documents inside! In this case, the app can take control of your device's core functions, just like an uninvited guest rummaging through your belongings. The potential fallout is absolutely devastating—an attacker could take over the entire operating system, access sensitive data, or even manipulate system settings at will. This is not just a minor inconvenience; it's a gateway for complete control over your device!

Put simply

Think of it as a delivery service that misplaces packages, allowing unauthorized users to access confidential documents inside! In this case, the app can take control of your device's core functions, just like an uninvited guest rummaging through your belongings. This vulnerability involves improper memory handling, allowing an application to execute code with elevated privileges. Essentially, the app tricks the operating system into running malicious commands without proper authorization, leading to a potential full system compromise.

What to do

The potential fallout is absolutely devastating—an attacker could take over the entire operating system, access sensitive data, or even manipulate system settings at will. This is not just a minor inconvenience; it's a gateway for complete control over your device! To safeguard your device, immediately update to iOS 13.3.1, iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, or watchOS 6.1.2. Regularly check for updates and enable automatic updates to ensure you stay protected against future vulnerabilities. 🛡️ You've got this! Keep your devices updated, and you'll be well on your way to securing your digital kingdom! 🔒✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.14839 · 96.7th percentile
Published
2020-02-27T20:45Z
KEV added
2022-06-27 · due 2022-07-18
EPSS history
Timeline
  • 27 JUN 00:00Z
    Added to CISA KEV — remediate by Jul 18
    kev
  • 27 FEB 20:45Z
    A memory corruption issue was addressed with improved memory handling
    cvelistv5