CVE-2020-9875

HIGH

Apple iCloud < 7.20 - Integer Overflow via Maliciously Crafted Image

Title source: llm
STIX 2.1

Description

An integer overflow was addressed through improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.

References (7)

Core 7
Core References
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT211289
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT211288
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT211290
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT211291
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT211293
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT211294
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT211295

Scores

CVSS v3 7.8
EPSS 0.0125
EPSS Percentile 65.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-190
Status published
Products (7)
apple/icloud < 7.20
apple/ipados < 13.6
apple/iphone_os < 13.6
apple/itunes < 12.10.8
apple/mac_os_x < 10.15.6
apple/tvos < 13.4.8
apple/watchos < 6.2.8
Published Oct 22, 2020
Tracked Since Feb 18, 2026