CVE-2020-3837: Apple iOS, iPadOS, macOS, tvOS, watchOS memory corruption kernel code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8 high severity, kernel-level code execution, and confirmed in-the-wild exploitation per CISA KEV make this a high-priority patch despite the local attack vector.

What it is

A memory corruption flaw (out-of-bounds write, CWE-787) in Apple iOS, iPadOS, macOS, tvOS and watchOS was fixed with improved memory handling in iOS 13.3.1, iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1 and watchOS 6.1.2. An application can trigger it to execute arbitrary code with kernel privileges, so it is a local privilege-escalation primitive that matters for post-compromise escalation and sandbox escape.

Impact

An attacker who can run an application on the target device gains arbitrary code execution at kernel privilege, breaking the platform's security boundary. This can lead to full device compromise, persistence and access to protected data.

Attack surface

The CVSS vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), meaning the victim must open or run a crafted application or file. No network vector or authentication requirement is described.

Exploitation

CVE-2020-3837 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-27), indicating exploitation in the wild; EPSS 30-day probability is 0.16111 (96.75th percentile). No ransomware campaign use is documented.

What to do

• Update all affected Apple devices to at least iOS 13.3.1, iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1 and watchOS 6.1.2, or later.
• Prioritize patching per CISA KEV required action and track remediation against the 2022-07-18 due date.
• Restrict users from running untrusted applications or opening untrusted files on unpatched devices.
• Inventory Apple endpoints and confirm no devices remain below the fixed versions.

Detection

• Monitor for unexpected kernel-level code execution or crashes on unpatched Apple devices.
• Alert on execution of untrusted or sideloaded applications on devices below the fixed OS versions.
• Use endpoint telemetry to flag privilege-escalation behavior following application launch on affected platforms.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.