CVE-2020-9934: Apple iOS, iPadOS, and macOS Input Validation Vulnerability

Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2022-09-08. EPSS: 3.2% chance of exploitation in the next 30 days.

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.

Affected products

• Apple iPadOS: before 13.6 (fixed in 13.6)
• Apple iPhone OS: before 13.6 (fixed in 13.6)
• Apple Mac OS X: before 10.15.6 (fixed in 10.15.6)

Published 2020-10-16. Last modified 2026-06-17.