Actively exploited in the wild

Apple Multiple Products Memory Corruption Vulnerability

Apple - Multiple Products · Listed in the CISA KEV since 2022-06-27. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2020-9907

HighCVSS 7.8KEV

Published: 16/10/2020(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6, iPadOS 13.6, and tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.

Risk Assessment

An application could execute arbitrary code with kernel privileges, potentially leading to full device compromise.

Recommendation

Update Apple devices to iOS 13.6, iPadOS 13.6, or tvOS 13.4.8 (or later).

Other vulnerabilities in Apple iOS, iPadOS, tvOS

CVE-2026-112687Medium
The issue was addressed by removing the vulnerable code. The vulnerability affects iOS 27.2 and iPadOS 27.2, and tvOS 27.2. An attacker on the local network may be able to cause unexpected system termination or corrupt process memory.

Original NVD description (English source)

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS