CVE-2020-9859KEV · OVERDUE

Apple Multiple Products Code Execution Vulnerability

High · published June 5, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 57.1th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.8
EPSS
1%
Percentile
57.1
In the wild
Confirmed
What it is

🚨 A sneaky memory consumption issue lets attackers execute arbitrary code with kernel privileges on Apple devices! 🔥 Think of it like a restaurant running out of kitchen space. If the kitchen is overwhelmed with orders, a sneaky chef could slip in and cook up something entirely unauthorized! This vulnerability could allow an attacker to gain control over the entire system, potentially stealing sensitive information or causing devastating damage. Imagine a rogue chef serving up chaos in a fine dining establishment – it's absolutely frightening!

Put simply

Think of it like a restaurant running out of kitchen space. If the kitchen is overwhelmed with orders, a sneaky chef could slip in and cook up something entirely unauthorized! This memory consumption vulnerability enables unauthorized code execution by exploiting flaws in memory handling in Apple’s operating systems. Once compromised, an attacker could leverage kernel privileges to perform malicious actions.

What to do

This vulnerability could allow an attacker to gain control over the entire system, potentially stealing sensitive information or causing devastating damage. Imagine a rogue chef serving up chaos in a fine dining establishment – it's absolutely frightening! To protect yourself, promptly update affected devices to iOS 13.5.1, iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, or watchOS 6.2.6. Ensuring that your devices are on the latest versions will secure them against this exploit. You've got this! With a few updates, your devices will be safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00829 · 57.1th percentile
Published
2020-06-05T14:40Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 05 JUN 14:40Z
    A memory consumption issue was addressed with improved memory handling
    cvelistv5