CVE-2020-3837
Apple Multiple Products Memory Corruption Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2020-3837
Description
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitation Context
as of October 13, 2026- CISA added CVE-2020-3837 to the KEV catalog 851 days after its CVE record was published.
- It is one of 95 Apple entries in the CISA KEV catalog, and one of 26 added in 2022.
- Its current EPSS score (14.8%) is higher than that of 31% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Apple iOS | unspecified to <iOS 13.3.1 and iPadOS 13.3.1 |
| Apple | Apple macOS | unspecified to <macOS Catalina 10.15.3 |
| Apple | Apple tvOS | unspecified to <tvOS 13.3.1 |
| Apple | Apple watchOS | unspecified to <watchOS 6.1.2 |
References
4 LinksRecord Details
More from Apple
Apple Multiple Products Integer Overflow Vulnerability
Apple Multiple Products Integer Overflow Vulnerability
Apple Multiple Products Memory Corruption Vulnerability
Apple Multiple Products WebKit Use-After-Free Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.