CVE-2020-9859

CVE-2020-9859 is a memory handling flaw in the kernels of Apple's operating systems (classified as CWE-415, a double free), addressed through improved memory handling by Apple. It is triggered by an application running on the device, and the local attack vector requires no user interaction. A successful exploit allows arbitrary code execution with kernel privileges, giving the attacker near-complete control of the affected device. Users of iPhone (iOS), iPad (iPadOS), Macs running macOS Catalina 10.15, Apple TV (tvOS), and Apple Watch (watchOS) on versions prior to the fixes are affected. The flaw was reported as a zero-day fixed by Apple and is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and it is associated in public reporting with the unc0ver jailbreak, though no public proof-of-concept is known.

What to do: Update to iOS/iPadOS 13.5.1 or later, apply the macOS Catalina 10.15.5 Supplemental Update, and update Apple TV (tvOS 13.4.6 or later) and Apple Watch (watchOS 6.2.6 or later), per the vendor's instructions as required by CISA KEV. Because this is a local privilege escalation, prioritize patching fleet devices where untrusted apps may run, and check for devices unable to upgrade (older iPhones/iPads, Apple TVs and watches stuck on pre-fix versions) as residual risk.