CVE-2020-27950: Apple XNU kernel memory initialization flaw leaks kernel memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA's KEV catalog with a high EPSS percentile, but impact is limited to kernel memory disclosure and exploitation requires local code execution plus user interaction.

What it is

A memory initialization issue in Apple's XNU kernel leaves kernel memory improperly initialized, allowing a malicious application to disclose kernel memory. It affects macOS, iOS, iPadOS and watchOS and was fixed across multiple Apple releases in late 2020. Kernel memory disclosure matters because leaked pointers and structures weaken ASLR and aid follow-on kernel exploitation.

Impact

An attacker running a malicious application gains read access to kernel memory contents, which can expose sensitive data and kernel layout details useful for further attacks. The flaw is information disclosure only; no code execution or integrity impact is described.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), so the attacker must get a malicious application running on the device and induce the user to trigger it. It is not remotely reachable and needs no authentication beyond local code execution.

Exploitation

CVE-2020-27950 is listed in CISA's Known Exploited Vulnerabilities catalog, indicating exploitation in the wild, and EPSS gives a 30-day probability of 0.1652 (96.8th percentile). No ransomware campaign use is documented, and reference tags are vendor advisories plus third-party and mailing-list write-ups, not public exploit code.

What to do

• Apply the Apple updates that fix this issue: macOS Big Sur 11.0.1, macOS Catalina 10.15.7 (Update and Supplemental Update), Security Update 2020-006 for High Sierra and Mojave, iOS 14.2/iPadOS 14.2, iOS 12.4.9, watchOS 7.1, 6.2.9 and 5.3.9.
• Enforce a minimum OS baseline so no managed Mac, iPhone, iPad or Apple Watch remains on a pre-fix build.
• Restrict users from installing or running untrusted applications, since exploitation requires a malicious app and user interaction.
• Track CISA KEV remediation deadlines for internet-exposed or high-value Apple endpoints and verify patched status through MDM inventory.
• Monitor for post-exploitation behavior on Apple endpoints that suggests kernel memory was harvested for a follow-on exploit.

Detection

• Inventory Apple devices via MDM and alert on any host reporting an OS build older than the fixed versions listed above.
• Hunt for unusual or unsigned applications being launched by users, since the attack requires a malicious app plus user interaction.
• Monitor endpoint telemetry for processes attempting to read kernel memory or abusing Mach message trailers, as described in the public Packet Storm write-up.
• Correlate suspicious local application activity with subsequent privilege-escalation or kernel-exploit attempts on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.