CVE-2020-9819: Apple iOS, iPadOS and watchOS mail message heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in CISA KEV with known exploitation, but the CVSS impact is limited to low availability and EPSS is low, so it ranks below critical.

What it is

A memory consumption flaw in Apple's Mail handling was fixed by improved memory handling in iOS 13.5, iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5 and watchOS 5.3.7. Processing a maliciously crafted mail message can cause heap corruption (CWE-787 out-of-bounds write). It matters because the affected code path is reachable from ordinary mail content on widely deployed mobile devices.

Impact

An attacker who gets a crafted mail message processed can corrupt heap memory, which may crash the mail client or, depending on heap layout, allow further memory manipulation. The CVSS vector rates only low availability impact, so the record does not establish code execution or data disclosure.

Attack surface

Reached over the network via a maliciously crafted mail message; the vector is AV:N/AC:L/PR:N/UI:R, so no authentication is needed but the victim must open or process the message.

Exploitation

CVE-2020-9819 is listed in CISA KEV (added 2021-11-03), indicating known exploitation, while EPSS is low at roughly 2.2 percent for 30 days. References are vendor advisories and the KEV entry; no public exploit details are given in the record.

What to do

• Update to iOS 13.5 or later, iPadOS 13.5 or later, iOS 12.4.7, watchOS 6.2.5 or watchOS 5.3.7 as applicable.
• Inventory devices still on versions below those fixed releases and prioritize them for patching.
• Restrict or filter inbound mail with untrusted attachments or unusual message structures at the gateway where feasible.
• For devices that cannot be updated promptly, limit mail access to trusted senders and monitor for mail client crashes.

Detection

• Monitor for repeated Mail or watchOS mail process crashes on managed devices, which can indicate malformed message handling.
• Alert on devices reporting OS versions below the fixed releases listed in the Apple advisories.
• Review mail gateway logs for messages matching known malicious message patterns or from untrusted senders.
• Correlate crash telemetry with received mail timestamps to identify a possible crafted-message trigger.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.