CVE-2020-9818KEV · OVERDUE

Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability

High · published June 9, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 83.0th percentile for exploit probability.

1635
days past CISA
deadline
CVSS v3.1
8.8
EPSS
2%
Percentile
83.0
In the wild
Confirmed
What it is

🚨 An out-of-bounds write vulnerability in your mail app could turn a simple email into a digital grenade! 💣 Think of it like a hotel room that’s supposed to fit two guests, but suddenly the door opens into a maintenance closet instead. If someone slips in a rogue message, it could cause chaos in the system, leading to unexpected behavior or crashing! An attacker could craft a malicious email that may lead to unexpected memory modifications or even force your application to terminate — talk about a rude surprise! This means losing access to important data and possibly compromising your device's security.

Put simply

Think of it like a hotel room that’s supposed to fit two guests, but suddenly the door opens into a maintenance closet instead. If someone slips in a rogue message, it could cause chaos in the system, leading to unexpected behavior or crashing! This vulnerability is due to insufficient bounds checking, allowing a maliciously crafted mail message to overwrite unexpected memory areas, potentially resulting in application failure or exploitation.

What to do

An attacker could craft a malicious email that may lead to unexpected memory modifications or even force your application to terminate — talk about a rude surprise! This means losing access to important data and possibly compromising your device's security. Update your device to iOS 13.5, iPadOS 13.5, iOS 12.4.7, or watchOS 6.2.5 to close this security gap. Ensure all applications are updated regularly to stay protected from future threats! You've got this! Stay vigilant and keep your devices patched for a safer digital experience! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02286 · 83.0th percentile
Published
2020-06-09T16:12Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 09 JUN 16:12Z
    An out-of-bounds write issue was addressed with improved bounds checking
    cvelistv5