CVE-2020-9907KEV · OVERDUE

Apple Multiple Products Memory Corruption Vulnerability

High · published October 16, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 88.0th percentile for exploit probability.

1558
days past CISA
deadline
CVSS v3.1
7.8
EPSS
3%
Percentile
88.0
In the wild
Confirmed
What it is

🚨 Just a tiny hiccup in memory management could let an attacker run wild with kernel privileges! 😱 Think of it like a construction crew being granted access to a secure area without proper oversight — they could change anything they wanted! If exploited, this vulnerability could allow an attacker to execute arbitrary code at the highest level of access, potentially taking full control of your device. Imagine someone slipping in while the guards are distracted, able to snoop through sensitive data or even take over the whole system!

Put simply

Think of it like a construction crew being granted access to a secure area without proper oversight — they could change anything they wanted! CVE-2020-9907 is a memory corruption issue that was resolved by removing the vulnerable code from the affected systems. This flaw allows a malicious application to execute code with kernel-level privileges, bypassing regular security restrictions.

What to do

If exploited, this vulnerability could allow an attacker to execute arbitrary code at the highest level of access, potentially taking full control of your device. Imagine someone slipping in while the guards are distracted, able to snoop through sensitive data or even take over the whole system! To mitigate this risk, update your devices to iOS 13.6, iPadOS 13.6, or tvOS 13.4.8 immediately. Keeping your systems up to date ensures you have the latest security patches in place to protect against exploits. 🛡️ You've got this! Keeping your devices updated will lock down your security and keep those pesky attackers at bay! 🔒

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03199 · 88.0th percentile
Published
2020-10-16T16:43Z
KEV added
2022-06-27 · due 2022-07-18
EPSS history
Timeline
  • 27 JUN 00:00Z
    Added to CISA KEV — remediate by Jul 18
    kev
  • 16 OCT 16:43Z
    A memory corruption issue was addressed by removing the vulnerable code
    cvelistv5