Apple iOS: A sandboxed process may be able to circumvent sandbox restrictions
Priority LOW 25Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A sandboxed process may be able to circumvent sandbox restrictions.
Why it matters now
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Fixed iOS (Apple): iOS 13.4 and iPadOS 13.4macOS (Apple): macOS Catalina 10.15.4+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apple | iOS | before iOS 13.4 and iPadOS 13.4 | iOS 13.4 and iPadOS 13.4 | Patch available | CNA |
| Apple | macOS | before macOS Catalina 10.15.4 | macOS Catalina 10.15.4 | Patch available | CNA |
| Apple | tvOS | before tvOS 13.4 | tvOS 13.4 | Patch available | CNA |
| Apple | watchOS | before watchOS 6.2 | watchOS 6.2 | Patch available | CNA |
- iOS VendorApple Affected before iOS 13.4 and iPadOS 13.4 Fixed in iOS 13.4 and iPadOS 13.4 Patch available CNA
- macOS VendorApple Affected before macOS Catalina 10.15.4 Fixed in macOS Catalina 10.15.4 Patch available CNA
- tvOS VendorApple Affected before tvOS 13.4 Fixed in tvOS 13.4 Patch available CNA
- watchOS VendorApple Affected before watchOS 6.2 Fixed in watchOS 6.2 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:* | before 13.4 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | before 13.4 | Vulnerable | Apple |
| cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | before 10.15.4 | Vulnerable | Apple |
| cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* | before 13.4 | Vulnerable | Apple |
| cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* | before 6.2 | Vulnerable | Apple |
- cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:* Versions before 13.4 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 13.4 Vulnerable ·Apple
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions before 10.15.4 Vulnerable ·Apple
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* Versions before 13.4 Vulnerable ·Apple
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* Versions before 6.2 Vulnerable ·Apple
Remediation
- Fix · CNA iOS (Apple) Fixed in iOS 13.4 and iPadOS 13.4
- Fix · CNA macOS (Apple) Fixed in macOS Catalina 10.15.4
- Fix · CNA tvOS (Apple) Fixed in tvOS 13.4
- Fix · CNA watchOS (Apple) Fixed in watchOS 6.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apple macOS macOS Catalina 10.15.4
9 records Highest priority Priority LOW 9 LOW
Other records, highest priority first
- TI-2020-07929 Improper input validation in Apple macOSPriority LOW 35
- TI-2020-07906 Out-of-bounds read in Apple macOSPriority LOW 35
- TI-2020-03415 Apple macOS: A malicious application may be able to overwrite arbitrary filesPriority LOW 34
- Release ·
Apple iOS, tvOS, watchOS iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2020-07866 Apple iOS: Some websites may not have appeared in Safari PreferencesPriority LOW 27
- TI-2020-03418 Apple iOS: A local user may be able to view sensitive user informationPriority LOW 25
Timeline
- 2026-10-02 Threatist record created from CVE-2020-9772
- 2026-10-03 Alias added: GHSA-4qrg-v6p3-7pjf
References
More Apple Ipad Os vulnerabilities
- TI-2022-06888 Use after free in Apple Safari CVSS 3.1HIGH 8.8
- TI-2022-06876 Out-of-bounds write in Apple Safari CVSS 3.1HIGH 8.8
- TI-2024-15360 Incorrect authorization in Apple iOS and iPadOS CVSS 3.1CRITICAL 9.1
- TI-2021-01529 Apple iOS and iPadOS: A remote attacker may be able to cause unexpected application… CVSS 3.1CRITICAL 9.8
- TI-2021-01509 Out-of-bounds write in Apple iOS and iPadOS CVSS 3.1CRITICAL 9.8
- TI-2021-01508 Out-of-bounds write in Apple iOS and iPadOS CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-9772 · CVE Program
- CVE-2020-9772 · NVD
- FIRST EPSS
- GHSA-4qrg-v6p3-7pjf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences