Apple iOS and macOS Kernel Double-Free Vulnerability Enabling Arbitrary Code Execution with Kernel Privileges (CVE-2020-9859)
Executive & SecOps Summary
SECOPS ASSESSMENTDevices running iOS/iPadOS versions prior to 13.5.1, macOS Catalina prior to 10.15.5 Supplemental Update, tvOS prior to 13.4.6, and watchOS prior to 6.2.6
A local application can exploit this vulnerability to execute arbitrary code with elevated kernel privileges, completely compromising the operating system
Immediately apply the official Apple security updates to transition to iOS/iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, or later
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To mitigate this vulnerability, update the target Apple devices to the patched versions immediately. For enterprise macOS fleets, administrators can force software updates via MDM or execute the following command in the terminal:
# Force check and install all pending macOS system updates including restarts
sudo softwareupdate --install --all --restart2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict the execution of unsigned or untrusted local applications to minimize the attack surface. On macOS, enforce strict Gatekeeper policies:
# Enable Gatekeeper to restrict execution to App Store and identified developers
sudo spctl --master-enable3. Log Audit & IoC Verification Commands
Use the following shell script to audit the current macOS version and verify if the system requires immediate patching:
# Check current macOS product version and build number
current_ver=$(sw_vers -productVersion)
current_build=$(sw_vers -buildVersion)
echo 'Detected macOS Version:' $current_ver
echo 'Detected Build:' $current_build
# Alert if the system is running an unpatched Catalina version
if [[ '$current_ver' == '10.15.5' && '$current_build' < '19F101' ]]; then
echo 'WARNING: System is vulnerable. Please apply the Supplemental Update immediately.'
fiBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-9859) is a double-free issue (CWE-415) residing within the memory handling routines of the Apple operating system kernel. It occurs due to improper state validation and reference counting when managing kernel memory allocations. When the kernel attempts to free an already deallocated memory pointer, it corrupts the kernel heap layout.
2. Exploitation Mechanics & Attack Scenario
A local attacker or a malicious application running on the target device can trigger this vulnerability by invoking specific system calls designed to manipulate kernel memory objects. By forcing a double-free condition, the attacker can corrupt the kernel heap structure, subsequently facilitating a Use-After-Free (UAF) scenario. This allows the attacker to overwrite critical kernel structures, hijack the execution flow, and execute arbitrary code within the context of the kernel.
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, it represents a highly active threat vector. Successful exploitation bypasses all operating system sandbox protections, granting the attacker full administrative control over the endpoint. This can lead to unauthorized access to sensitive corporate data, credential theft, and persistent compromise of enterprise endpoints.
Official Vendor Advisories & References
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.
Frequently Asked SecOps Questions (CVE-2020-9859)
FAQQ1. How critical is CVE-2020-9859 and is it actively exploited in the wild?
CVE-2020-9859 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 0.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-9859?
Primary impacted vendors include apple across ios, ipados, macos, tvos, watchos. Scope summary: Apple iOS and iPadOS prior to 13.5.1, macOS Catalina prior to 10.15.5 Supplemental Update, tvOS prior to 13.4.6, and watchOS prior to 6.2.6
Q3. What temporary mitigations or workarounds exist for CVE-2020-9859 before patching?
[Mitigation] Immediately apply the official Apple security updates to transition to iOS/iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-9859
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apple)
View Category →Apple iOS, macOS, and watchOS Memory Corruption Arbitrary Code Execution Vulnerability (CVE-2026-20700)
[Affected Scope] Apple devices running iOS before 26.3, iPadOS before 26.3, macOS Tahoe before 26.3, tvOS before 26.3, visionOS before 26.3, and watchOS before 26.3
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.