CVE-2020-27918

7.8 highEPSS 1.4%

High (7.8). EPSS 1.4% chance of exploitation in the next 30 days.

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-416
Published: 2020-12-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apple:icloud
apple:ipados
apple:iphone_os
apple:itunes
apple:macos
apple:safari
apple:tvos
apple:watchos
debian:debian_linux
fedoraproject:fedora
webkitgtk:webkitgtk\+

References

http://seclists.org/fulldisclosure/2020/Dec/32
http://www.openwall.com/lists/oss-security/2021/03/22/1
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EQ3U3VBSOJB46WCO66TEWE5OAXLTU3YW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/

Check your stack JSON