---
id: "CVE-2020-9934"
kind: "vulnerability"
aliases: ["CVE-2020-9934"]
title: "An issue existed in the handling of environment variables"
severity: "medium"
cvss: 5.5
epss: 0.03208
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple iOS, iPadOS, and macOS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["13.6"], "affected": "< 13.6", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["13.6"], "affected": "< 13.6", "ecosystem": "vendor"}, {"name": "apple mac os x", "fixed": ["10.15.6"], "affected": "< 10.15.6", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple-devices", "exploited", "ios", "ipados", "macos", "vendor"]
not_affected_if: ["fully-patched-devices"]
published_at: "2020-10-16T17:15:17+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-9934", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-9934", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9934", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# An issue existed in the handling of environment variables

Apple iOS, iPadOS and macOS have an input validation flaw that lets a local attacker view sensitive user information. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple iOS, iPadOS, and macOS affected ? fixed ?
- vendor:apple ipados affected < 13.6 fixed 13.6
- vendor:apple iphone os affected < 13.6 fixed 13.6
- vendor:apple mac os x affected < 10.15.6 fixed 10.15.6

## Fix

Apply the Apple updates for iOS, iPadOS and macOS per vendor instructions; the specific fixed versions are not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-9934
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-9934
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-9934

## From the sources

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_