---
id: "CVE-2020-9907"
kind: "vulnerability"
aliases: ["CVE-2020-9907"]
title: "A memory corruption issue was addressed by removing the vulnerable code"
severity: "critical"
cvss: 9.3
epss: 0.03199
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Apple Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["13.6"], "affected": "< 13.6", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["13.6"], "affected": "< 13.6", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["13.4.8"], "affected": "< 13.4.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple-devices", "exploited", "infrastructure", "ios", "ipados", "tvos"]
not_affected_if: ["unpatched-os-not-in-use"]
published_at: "2020-10-16T17:15:16+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-9907", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-9907", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9907", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# A memory corruption issue was addressed by removing the vulnerable code

Apple iOS, iPadOS and tvOS have a memory corruption bug in a component that a regular app can reach. A malicious app can run code with kernel privileges, which means full control of the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple Multiple Products affected ? fixed ?
- vendor:apple ipados affected < 13.6 fixed 13.6
- vendor:apple iphone os affected < 13.6 fixed 13.6
- vendor:apple tvos affected < 13.4.8 fixed 13.4.8

## How to check

Check the device OS version in Settings > General > About (iOS/iPadOS) or Settings > General > Software Update (tvOS). unknown for managed fleet tooling.

## Fix

Update iOS, iPadOS and tvOS to a release Apple lists as fixed for CVE-2020-9907, per Apple's vendor instructions. Specific fixed versions: unknown from these sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-9907
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-9907
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-9907

## From the sources

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_