Apple · iOS, iPadOS, and watchOS

CVE-2020-9819

Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability

Exploited in attacks Medium 4.3 Attack chance: 2.2%

What it is

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.

CISA: Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: June 9, 2020
Severity: Medium 4.3 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 2.2% in the top 17.3% of all known vulnerabilities
Weakness: CWE-787
More details: NVD · CVE.org · CISA

All references (4)

More exploited flaws from Apple

Added	Vulnerability	Product	Severity	Attack chance
Sep 11, 2023	Wallet Code ExecutionCVE-2023-41061	iOS, iPadOS, and watchOS	High 7.8	4.4%
Nov 3, 2021	Out-of-Bounds WriteCVE-2020-9818	iOS, iPadOS, and watchOS	High 8.8	2.3%
Nov 3, 2021	WebKit Cross-Site Scripting (XSS)CVE-2021-1879	iOS, iPadOS, and watchOS	Medium 6.1	7.1%
Sep 29, 2026	Out-of-Bounds WriteCVE-2026-86950	Multiple Products	High 8.8	26%
Aug 18, 2026	Improper AuthenticationCVE-2026-65400	macOS	Critical 9.8	1.7%
Mar 20, 2026	Buffer OverflowCVE-2025-31277	Multiple Products	High 8.8	1.7%
Mar 20, 2026	Improper LockingCVE-2025-43510	Multiple Products	High 7.8	0.4%
Mar 20, 2026	Classic Buffer OverflowCVE-2025-43520	Multiple Products	Medium 5.5	0.4%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.