Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2020-9819 is a medium-severity Out-of-bounds Write (CWE-787) vulnerability in Apple Iphone Os. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked in the top 18% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A memory consumption issue addressed through improved memory handling affects the Mail component in multiple Apple operating systems. The vulnerability, tracked as CVE-2020-9819 with CWE-787, can trigger heap corruption when a maliciously crafted mail message is processed. Impacted platforms include iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, and watchOS 5.3.7, and the flaw carries a CVSS v3.1 score of 4.3 reflecting network attack vector, low complexity, required user interaction, and limited availability impact.
An unauthenticated remote attacker can exploit the issue by delivering a specially crafted email that the victim processes in the Mail application. Successful exploitation may result in heap corruption that disrupts service availability, though it does not enable direct confidentiality or integrity compromise under the reported scoring.
Apple security advisories HT211168, HT211169, HT211175, and HT211176 state that the issue is resolved by updating to the listed iOS, iPadOS, and watchOS versions, which incorporate the corrected memory handling. No additional workarounds are described in the references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30598
Vulnerability Data
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.