---
id: "CVE-2020-3837"
kind: "vulnerability"
aliases: ["CVE-2020-3837"]
title: "A memory corruption issue was addressed with improved memory handling"
severity: "critical"
cvss: 9.3
epss: 0.14839
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Apple Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["13.3.1"], "affected": "< 13.3.1", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["13.3.1"], "affected": "< 13.3.1", "ecosystem": "vendor"}, {"name": "apple mac os x", "fixed": ["10.15.3"], "affected": "< 10.15.3", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["13.3.1"], "affected": "< 13.3.1", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["6.1.2"], "affected": "< 6.1.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple-devices", "exploited", "infrastructure", "ios", "ipados", "macos", "tvos", "watchos"]
not_affected_if: ["fully-patched-devices"]
published_at: "2020-02-27T21:15:16+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-3837", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-3837", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3837", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# A memory corruption issue was addressed with improved memory handling

A memory corruption bug in Apple's iOS, iPadOS, macOS, tvOS and watchOS lets an app running on the device execute code with kernel privileges. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple Multiple Products affected ? fixed ?
- vendor:apple ipados affected < 13.3.1 fixed 13.3.1
- vendor:apple iphone os affected < 13.3.1 fixed 13.3.1
- vendor:apple mac os x affected < 10.15.3 fixed 10.15.3
- vendor:apple tvos affected < 13.3.1 fixed 13.3.1
- vendor:apple watchos affected < 6.1.2 fixed 6.1.2

## How to check

Check the OS version on each Apple device (Settings > General > About on iOS/iPadOS, or Apple menu > About This Mac on macOS) and compare it to the fixed release in Apple's advisory.

## Fix

Update the affected Apple devices to a current OS release per Apple's security advisory; the fixed version numbers are not in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-3837
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-3837
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-3837

## From the sources

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_