What is CVE-2020-27911?

CVE-2020-27911 is a high-severity vulnerability in Apple Icloud, classified under Integer Overflow or Wraparound. CVSS score: 7.8/10. Published 2020-12-08.

How severe is CVE-2020-27911?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2020-27911 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Integer overflow in Apple Icloud

CVE-2020-27911

An integer overflow was addressed through improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.

Vulnerability class: Integer Overflow

Published 2020-12-08 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.034 (88.4th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 88.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.033 · newest: 0.034 · change: +0.001

Affected products

Apple Icloud
Apple iOS And Ipados — versions unspecified
Apple Ipados
Apple Iphone OS
Apple Itunes
Apple macOS — versions unspecified
Apple tvOS — versions unspecified
Apple watchOS — versions unspecified

Weakness classification (CWE)

CWE-190 — Integer Overflow or Wraparound

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

support.apple.com/en-us/HT211931 (Vendor Advisory)
support.apple.com/en-us/HT211935 (Vendor Advisory)
support.apple.com/en-us/HT211928 (Vendor Advisory)
support.apple.com/en-us/HT211929 (Vendor Advisory)
support.apple.com/en-us/HT211930 (Vendor Advisory)
support.apple.com/en-us/HT211933 (Vendor Advisory)
support.apple.com/kb/HT212011 (Vendor Advisory)
seclists.org/fulldisclosure/2020/Dec/32 (mailing-list, Mailing List, Third Party Advisory)
seclists.org/fulldisclosure/2020/Dec/26 (mailing-list, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2020-27911?: CVE-2020-27911 is a high-severity vulnerability in Apple Icloud, classified under Integer Overflow or Wraparound. CVSS score: 7.8/10. Published 2020-12-08.
How severe is CVE-2020-27911?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2020-27911 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.