CVE-2020-9934

KEVApple iOS, iPadOS, and macOS Input Validation Vulnerability

Description

Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

PublishedOct 16, 2020

Last modifiedJun 17, 2026

Added to KEVSep 8, 2022

Remediation dueSep 29, 2022

References

support.apple.com/HT211288Release NotesVendor Advisory
support.apple.com/HT211289Release NotesVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9934US Government Resource

0 recent articles mention this CVE

Risk assessment · Medium

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1489 days
CVSS: 5.5 MEDIUM
EPSS (30-day exploit probability): 3.2% · top 12% of all CVEs
Weakness: NVD-CWE-noinfo

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.