Out-of-bounds read in Apple iTunes for Windows
Priority LOW 32CWE-125Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iCloud for Windows 11.4, iOS 14.0 and iPadOS 14.0, watchOS 7.0, tvOS 14.0, iCloud for Windows 7.21, iTunes for Windows 12.10.9. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix Fixed iTunes for Windows (Apple): 12.10iOS and iPadOS (Apple): 14.0+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apple | iTunes for Windows | before 12.10 | 12.10 | Patch available | CNA |
| Apple | iOS and iPadOS | before 14.0 | 14.0 | Patch available | CNA |
| Apple | iCloud for Windows | before 11.4 | 11.4 | Patch available | CNA |
| Apple | iCloud for Windows | before 7.21 | 7.21 | Patch available | CNA |
| Apple | watchOS | before 7.0 | 7.0 | Patch available | CNA |
| Apple | watchOS | before 14.0 | 14.0 | Patch available | CNA |
- iTunes for Windows VendorApple Affected before 12.10 Fixed in 12.10 Patch available CNA
- iOS and iPadOS VendorApple Affected before 14.0 Fixed in 14.0 Patch available CNA
- iCloud for Windows VendorApple Affected before 11.4 Fixed in 11.4 Patch available CNA
- iCloud for Windows VendorApple Affected before 7.21 Fixed in 7.21 Patch available CNA
- watchOS VendorApple Affected before 7.0 Fixed in 7.0 Patch available CNA
- watchOS VendorApple Affected before 14.0 Fixed in 14.0 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* | before 7.21; 11.0 to before 11.4 | Vulnerable | Apple |
| cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* | before 12.10.9 | Vulnerable | Apple |
| cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Apple |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | before 10.15.7 | Vulnerable | Apple |
| cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* | before 14.0 | Vulnerable | Apple |
| cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* | before 7.0 | Vulnerable | Apple |
- cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* Versions before 7.21; 11.0 to before 11.4 Vulnerable ·Apple
- cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* Versions before 12.10.9 Vulnerable ·Apple
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Apple
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 10.15.7 Vulnerable ·Apple
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* Versions before 14.0 Vulnerable ·Apple
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* Versions before 7.0 Vulnerable ·Apple
Remediation
- Fix · CNA iTunes for Windows (Apple) Fixed in 12.10
- Fix · CNA iOS and iPadOS (Apple) Fixed in 14.0
- Fix · CNA iCloud for Windows (Apple) Fixed in 11.4
- Fix · CNA iCloud for Windows (Apple) Fixed in 7.21
- Fix · CNA watchOS (Apple) Fixed in 7.0
- Fix · CNA watchOS (Apple) Fixed in 14.0
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36521
- 2026-10-03 Alias added: GHSA-f54m-mh6r-hqvj
References
More Apple Icloud vulnerabilities
- TI-2019-06084 Type confusion in Apple iOS KEVCVSS 3.1HIGH 8.8
- TI-2020-16987 Type confusion in Apple watchOS KEVCVSS 3.1HIGH 7.8
- TI-2020-07926 Apple iOS: A remote attacker may be able to cause arbitrary code execution CVSS 3.1CRITICAL 9.8
- TI-2018-03187 Memory corruption in Apple WebKit CVSS 3.1HIGH 8.8
- TI-2018-03118 Memory corruption in Apple WebKit CVSS 3.0HIGH 8.8
- TI-2018-03361 Memory corruption in iOS, tvOS, watchOS, Safari, iTunes for Windows, iCloud for Windows CVSS 3.0HIGH 8.8
Sources
- CVE-2020-36521 · CVE Program
- CVE-2020-36521 · NVD
- FIRST EPSS
- GHSA-f54m-mh6r-hqvj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences