CVE-2020-9818: Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 2.3% chance of exploitation in the next 30 days.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.

Affected products

• Apple iPadOS: before 13.5 (fixed in 13.5)
• Apple iPhone OS: before 12.4.7 (fixed in 12.4.7); from 13.0, before 13.5 (fixed in 13.5)
• Apple watchOS: before 6.2.5 (fixed in 6.2.5)

Published 2020-06-09. Last modified 2026-06-17.