CVE-2020-3837: high-severity vulnerability in Apple iOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply updates per vendor instructions.
A memory corruption vulnerability in Apple systems allows malicious applications to execute arbitrary code with the highest system privileges (kernel level). This could let attackers take complete control of the device.
A buffer overflow or out-of-bounds write (CWE-787) in memory handling permitted arbitrary code execution in kernel context. Exploitation required a malicious application with local execution capabilities; the vulnerability was patched by hardening memory management across iOS, iPadOS, macOS, tvOS, and watchOS platforms.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.