CVE-2020-9859: Apple iOS, iPadOS, macOS, tvOS and watchOS double free allows kernel code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityKernel-level code execution with a CVSS of 7.8 and confirmed exploitation in CISA KEV makes this a high-priority patching target despite the local attack vector.

What it is

A memory consumption issue in Apple's operating systems was caused by a double free (CWE-415) and fixed through improved memory handling. An application can exploit the flaw to execute arbitrary code with kernel privileges, which is the highest level of access on the device. The issue affects iOS, iPadOS, macOS Catalina, tvOS and watchOS and was patched in June 2020 updates.

Impact

An attacker who can run code on the target device gains kernel-level code execution, allowing full control of the operating system, including bypassing security protections and accessing sensitive data.

Attack surface

The CVSS vector is local (AV:L) with low privileges (PR:L) and no user interaction (UI:N), meaning the attacker must already be able to run an application on the device. No remote or network vector is described in the record.

Exploitation

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild, while EPSS is low at roughly 0.8% for the next 30 days. No ransomware use is documented.

What to do

• Apply the vendor updates: iOS 13.5.1, iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6 and watchOS 6.2.6.
• Inventory Apple devices and confirm all are on or above the fixed versions; prioritize macOS and iOS endpoints.
• Restrict installation of untrusted or unsigned applications, since exploitation requires running code locally.
• Monitor CISA KEV guidance and apply the required action per vendor instructions by the due date.

Detection

• Monitor for unexpected kernel panics or crashes that may indicate double-free exploitation attempts.
• Audit application installation and execution logs for untrusted or sideloaded apps on managed Apple devices.
• Track endpoint telemetry for processes gaining kernel-level privileges outside normal system behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.