CVE-2020-9818

CVE-2020-9818 is an out-of-bounds write vulnerability (CWE-787) in the mail handling components of Apple iOS, iPadOS, and watchOS, caused by insufficient bounds checking. An attacker can trigger the flaw by sending a maliciously crafted email message that the device processes, requiring user interaction but no privileges or authentication beyond message delivery. Successful processing of the crafted message can cause unexpected memory modification or termination of the affected application, with the CVSS 3.1 score of 8.8 reflecting potentially high confidentiality, integrity, and availability impact. All users of iPhones and iPads running iOS/iPadOS versions before 13.5 (or iOS 12.x before 12.4.7) and Apple Watches running watchOS before 6.2.5 are affected. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog as of November 3, 2021, indicating confirmed in-the-wild exploitation, though no public proof-of-concept is known and ransomware use is unconfirmed.

What to do: Update iPhones and iPads to iOS/iPadOS 13.5 or later, or to iOS 12.4.7 or later for devices stuck on the iOS 12 branch, and update Apple Watches to watchOS 6.2.5 or later. Check fleet device OS versions via MDM or device settings to confirm no endpoints remain on vulnerable builds; there is no known workaround beyond patching, so treat inbound email processing on unpatched devices as an attack vector.