CVE-2020-9907: Apple iOS, iPadOS and tvOS out-of-bounds write in kernel code

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw gives kernel-level code execution and is confirmed exploited in CISA KEV, though it requires local user interaction to run a malicious app.

What it is

A memory corruption flaw (out-of-bounds write) in Apple iOS, iPadOS and tvOS was fixed by removing the vulnerable code in iOS 13.6, iPadOS 13.6 and tvOS 13.4.8. Successful abuse lets an application execute arbitrary code with kernel privileges, so it breaks the boundary between user apps and the kernel. The record does not name the specific component or function involved.

Impact

An attacker who gets a malicious application running on the device can execute arbitrary code at kernel level, gaining full control of the operating system and bypassing app sandbox restrictions.

Attack surface

The CVSS vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), meaning the victim must run or open the crafted application. No network or remote vector is described.

Exploitation

CVE-2020-9907 is listed in CISA KEV with a 2022-06-27 addition date, confirming exploitation in the wild; EPSS 30-day probability is about 3.9 percent (89.7th percentile). References are vendor advisories and the KEV entry only, with no public exploit details in this record.

What to do

• Update to iOS 13.6, iPadOS 13.6 or tvOS 13.4.8 or later as directed by Apple advisories HT211288 and HT211290.
• Enforce a minimum OS version baseline on managed iPhones, iPads and Apple TVs and block or flag devices below it.
• Restrict app installation to trusted sources and review enterprise-signed or sideloaded apps, since exploitation requires running a malicious application.
• Treat jailbroken or unmanaged devices as high risk and isolate them from sensitive corporate data and services.
• Monitor Apple security advisories for follow-up fixes affecting the same code path.

Detection

• Inventory iOS, iPadOS and tvOS versions and alert on any device below 13.6 / 13.4.8.
• Hunt for unexpected kernel panics, crashes or reboots on Apple devices that could indicate memory corruption exploitation.
• Review mobile device management logs for sideloaded, enterprise-signed or otherwise untrusted applications on managed devices.
• Correlate endpoint or MDM telemetry for suspicious app behavior immediately preceding kernel-level anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.