CVE-2020-9907highunder attackCWE-787

CVE-2020-9907: high-severity vulnerability in Apple iOS

Published · Updated

Follow this CVE+ Monitor iOS+ Monitor tvOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 3.2%
from disclosure to weapon
Published on NVDOct 16
CISA KEV+619d
Action required by CISAfederal deadline: 2022-07-18

Apply updates per vendor instructions.

In short

A memory corruption vulnerability in Apple's operating systems allowed apps to run malicious code with the highest system privileges (kernel level). This could let attackers take complete control of your device.

Technical detail

A memory corruption vulnerability (CWE-787: out-of-bounds write) in iOS, iPadOS, and tvOS allowed local applications to execute arbitrary code with kernel privileges. The vulnerability was addressed by removing the vulnerable code path; exploitation required execution context on the affected device.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iOSApple · tvOS
Related CVEs — Apple iOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2025-43529HIGHCVE-2025-43529EPSS 25.7%KEVCVE-2025-31200CRITICALCVE-2025-31200EPSS 20.9%KEVCVE-2023-37450HIGHCVE-2023-37450EPSS 18.9%KEVCVE-2019-8605HIGHCVE-2019-8605EPSS 17.6%KEVCVE-2025-24085CRITICALCVE-2025-24085EPSS 17.4%KEV