CVE-2020-9819mediumunder attackCWE-787

CVE-2020-9819: medium-severity vulnerability in Apple iOS

Published · Updated

Follow this CVE+ Monitor iOS+ Monitor iPadOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 4.3epss 2.2%
from disclosure to weapon
Published on NVDJun 9
CISA KEV+512d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A specially crafted email message can cause excessive memory usage or heap corruption on Apple devices, potentially crashing the mail app or causing instability.

Technical detail

A heap buffer overflow vulnerability exists in iOS/iPadOS mail processing that allows an attacker to send a maliciously crafted email message, triggering memory corruption without requiring user interaction beyond receiving the message. The vulnerability affects iOS 13.4 and earlier, iOS 12.4.6 and earlier, and watchOS versions prior to 6.2.5 and 5.3.7.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Apple · iOSApple · iOS-1Apple · watchOSApple · watchOS-1
Related CVEs — Apple iOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 51.5%KEVCVE-2025-43529HIGHCVE-2025-43529EPSS 25.7%KEVCVE-2020-27930HIGHCVE-2020-27930EPSS 22.0%KEVCVE-2025-31200CRITICALCVE-2025-31200EPSS 20.9%KEVCVE-2023-37450HIGHCVE-2023-37450EPSS 18.9%KEV