Apple · iOS, iPadOS, and watchOS
CVE-2020-9818
Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability
What it is
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.
CISA: Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 11, 2023 | Wallet Code Execution | iOS, iPadOS, and watchOS | High 7.8 | 4.4% |
| Nov 3, 2021 | Memory Corruption | iOS, iPadOS, and watchOS | Medium 4.3 | 2.2% |
| Nov 3, 2021 | WebKit Cross-Site Scripting (XSS) | iOS, iPadOS, and watchOS | Medium 6.1 | 7.1% |
| Sep 29, 2026 | Out-of-Bounds Write | Multiple Products | High 8.8 | 26% |
| Aug 18, 2026 | Improper Authentication | macOS | Critical 9.8 | 1.7% |
| Mar 20, 2026 | Buffer Overflow | Multiple Products | High 8.8 | 1.7% |
| Mar 20, 2026 | Improper Locking | Multiple Products | High 7.8 | 0.4% |
| Mar 20, 2026 | Classic Buffer Overflow | Multiple Products | Medium 5.5 | 0.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.