Actively exploited · Published Dec 8, 2020 · Assigned by apple

CVE-2020-27930

High 7.8 Exploited

In plain English

A high-severity out-of-bounds write in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 22.0% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)22.0%top 2.3% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. Processing a maliciously crafted font may lead to arbitrary code execution.

Affected products (as reported)

Vendor	Product	Versions
Apple	watchOS	unspecified – before 7.1
Apple	iOS and iPadOS	unspecified – before 14.2
Apple	macOS	unspecified – before 11.0
Apple	macOS	unspecified – before 12.4
Apple	macOS	unspecified – before 6.2
Apple	macOS	unspecified – before 5.3
Apple	macOS	unspecified – before 2020
Apple	macOS	unspecified – before 10.15

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://support.apple.com/en-us/HT211931 x_refsource_MISC
https://support.apple.com/en-us/HT211928 x_refsource_MISC
https://support.apple.com/en-us/HT211929 x_refsource_MISC
https://support.apple.com/en-us/HT211940 x_refsource_MISC
https://support.apple.com/en-us/HT211944 x_refsource_MISC
https://support.apple.com/en-us/HT211945 x_refsource_MISC
https://support.apple.com/en-us/HT211946 x_refsource_MISC
https://support.apple.com/en-us/HT211947 x_refsource_MISC
20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1 mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/161294/Apple-Safari-Remote-Code-Execution.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27930 government-resource