CVE-2020-9955
📋 TL;DR
This vulnerability allows arbitrary code execution by processing a maliciously crafted image due to an out-of-bounds write issue. It affects Apple devices running older versions of iOS, iPadOS, macOS, tvOS, and watchOS. Attackers can exploit this to gain control of affected devices.
💻 Affected Systems
- iPhone
- iPad
- Mac
- Apple Watch
- Apple TV
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to data theft, surveillance, ransomware deployment, or use as a botnet node.
Likely Case
Targeted attacks against specific users via malicious images, potentially leading to data exfiltration or credential theft.
If Mitigated
No impact if devices are fully patched or if image processing is restricted to trusted sources.
🎯 Exploit Status
Exploitation requires user interaction to process a malicious image, but no authentication is needed once the image is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: watchOS 7.0, tvOS 14.0, iOS 14.0, iPadOS 14.0, macOS Big Sur 11.0.1
Vendor Advisory: https://support.apple.com/en-us/HT211843
Restart Required: Yes
Instructions:
1. Go to Settings > General > Software Update on iOS/iPadOS/watchOS/tvOS or System Preferences > Software Update on macOS. 2. Download and install the latest available update. 3. Restart the device when prompted.
🔧 Temporary Workarounds
Disable automatic image processing
allPrevent automatic loading of images in email clients and web browsers
Restrict image sources
allOnly open images from trusted sources and avoid downloading unknown image files
🧯 If You Can't Patch
- Isolate affected devices from critical networks and sensitive data
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check OS version in Settings > General > About on iOS/iPadOS/watchOS/tvOS or About This Mac on macOSCheck Version:
On macOS: sw_vers -productVersion; On iOS/iPadOS: Settings > General > About > VersionVerify Fix Applied:
Verify OS version matches or exceeds the patched versions listed in the fix section📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes in image processing applications
- Unusual network connections from image viewing applications
Network Indicators:
- Outbound connections to suspicious IPs after image file access
- DNS queries for known malicious domains following image processing
SIEM Query:
source="apple_system_logs" AND (process="image*" OR process="Photos" OR process="Preview") AND event_type="crash"🔗 References
- https://support.apple.com/en-us/HT211843
- https://support.apple.com/en-us/HT211844
- https://support.apple.com/en-us/HT211850
- https://support.apple.com/en-us/HT211931
- https://support.apple.com/en-us/HT211843
- https://support.apple.com/en-us/HT211844
- https://support.apple.com/en-us/HT211850
- https://support.apple.com/en-us/HT211931
