{"id":"CVE-2020-3837","published":"2020-02-27T21:15:16Z","modified":"2026-06-17T03:19:07Z","title":"Apple Multiple Products Memory Corruption Vulnerability","vendor":"Apple","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a memory corruption vulnerability in Apple's multiple products, which include iOS, iPadOS, macOS, tvOS and watchOS, that was addressed through improved memory handling. An attacker who can get a malicious application to run locally, with user interaction required, could execute arbitrary code with kernel privileges and so fully compromise the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:13Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.14774,"percentile":0.96677,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-06-27","dueDate":"2022-07-18","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-3837","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-06-23","exploitedFirstSeen":"2022-06-23","ransomware":false,"evidence":[{"url":"https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/","date":"2022-06-23"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-06-27"},{"url":"https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/","date":"2023-03-29"},{"url":"https://www.threatfabric.com/blogs/lightspy-implant-for-ios","date":"2024-10-29"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://support.apple.com/HT210918","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT210919","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT210920","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT210921","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT210918","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT210919","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT210920","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT210921","tags":["Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3837","tags":["US Government Resource"]}],"techniques":[{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Memory corruption exploited locally; no specific technique named","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A memory corruption issue was addressed with improved memory handling","start":0,"end":69}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Kernel code execution implies privilege escalation","mappingType":"primary_impact","evidence":[{"from":"description","quote":"An application may be able to execute arbitrary code with kernel privileges","start":176,"end":251}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-25102","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25102","exploited":true,"exploitedSince":"2022-06-27","provenance":"source"},"exploits":[{"id":48035,"url":"https://www.exploit-db.com/exploits/48035","title":"iOS/macOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()","type":"dos","platform":"multiple","date":"2020-02-10","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-02-10"},"first":{"date":"2020-02-10","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/48035"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1211"],"provenance":"ai"},{"stage":"primary","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2020-02-10","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-48035)","url":"https://www.exploit-db.com/exploits/48035","provenance":"source"},{"date":"2020-02-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3837","provenance":"source"},{"date":"2022-06-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/","provenance":"source"},{"date":"2022-06-27","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-06-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-25102","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":851},"priority":{"score":67.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1591 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.34,"detail":"percentile 0.9668"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apple-ios-macos-cwe-787"}}