CVE-2020-9999: Apple iCloud

High severity, CVSS 7.8. EPSS: 8% chance of exploitation in the next 30 days.

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, iTunes for Windows 12.10.9. Processing a maliciously crafted text file may lead to arbitrary code execution.

Affected products

• Apple iCloud: before 11.5.0 (fixed in 11.5.0)
• Apple iPadOS: before 14.0 (fixed in 14.0)
• Apple iPhone OS: before 14.0 (fixed in 14.0)
• Apple iTunes: before 12.10.9 (fixed in 12.10.9)
• Apple Mac OS X: before 11.0.1 (fixed in 11.0.1)
• Apple tvOS: before 14.0 (fixed in 14.0)
• Apple watchOS: before 7.0 (fixed in 7.0)

Published 2020-12-08. Last modified 2026-06-17.