Apple · iOS, iPadOS, and macOS
CVE-2020-9934
Apple iOS, iPadOS, and macOS Input Validation Vulnerability
What it is
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
CISA: Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: September 29, 2022
- Added to the CISA list
- September 8, 2022
- Published
- October 16, 2020
- Severity
- Medium 5.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 3.2% in the top 11.9% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (2)
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 21, 2025 | Out-of-Bounds Write | iOS, iPadOS, and macOS | Critical 10.0 | 65% |
| Sep 11, 2023 | ImageIO Buffer Overflow | iOS, iPadOS, and macOS | High 7.8 | 53% |
| Apr 10, 2023 | IOSurfaceAccelerator Out-of-Bounds Write | iOS, iPadOS, and macOS | High 8.6 | 23% |
| Mar 30, 2023 | Out-of-Bounds Write | iOS, iPadOS, and macOS | High 7.8 | 5.2% |
| Sep 14, 2022 | Remote Code Execution | iOS, iPadOS, and macOS | High 7.8 | 5.6% |
| Feb 11, 2022 | Webkit Use-After-Free | iOS, iPadOS, and macOS | High 8.8 | 16% |
| Nov 3, 2021 | WebKit Remote Code Execution | iOS, iPadOS, and macOS | Critical 9.8 | 7.7% |
| Nov 3, 2021 | WebKit Remote Code Execution | iOS, iPadOS, and macOS | Critical 9.8 | 7.0% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.