Live › vulnerability › CVE-2020-9907
Go to dashboardApple iOS, iPadOS and tvOS have a memory corruption bug in a component that a regular app can reach. A malicious app can run code with kernel privileges, which means full control of the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apple Multiple Products | vendor | – | – |
| apple ipados | vendor | < 13.6 | 13.6 |
| apple iphone os | vendor | < 13.6 | 13.6 |
| apple tvos | vendor | < 13.4.8 | 13.4.8 |
Check the device OS version in Settings > General > About (iOS/iPadOS) or Settings > General > Software Update (tvOS). unknown for managed fleet tooling.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.
This page as .md · .json · in your agent: get_signal("CVE-2020-9907")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.