What is CVE-2020-9883?

CVE-2020-9883 is a high-severity vulnerability in Apple Icloud, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.8/10. Published 2020-10-22.

How severe is CVE-2020-9883?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2020-9883 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Apple Icloud

CVE-2020-9883

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.

Vulnerability class: Buffer Overflow

Published 2020-10-22 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.060 (93.1th percentile), scored 2026-10-01.

Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 93.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.060 · newest: 0.060 · change: 0.000

Affected products

Apple Icloud
Apple Icloud For Windows — versions unspecified
Apple Icloud For Windows (Legacy) — versions unspecified
Apple iOS — versions unspecified
Apple Ipados
Apple Iphone OS
Apple Itunes
Apple Itunes For Windows — versions unspecified
Apple macOS — versions unspecified, 11.0.1
Apple Mac OS X — versions 10.13.6, 10.14.6

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

Public proof-of-concept exploits

Live-Hack-CVE/CVE-2020-9883

References

support.apple.com/kb/HT211289 (Vendor Advisory)
support.apple.com/kb/HT211288 (Vendor Advisory)
support.apple.com/kb/HT211290 (Vendor Advisory)
support.apple.com/kb/HT211291 (Vendor Advisory)
support.apple.com/kb/HT211293 (Vendor Advisory)
support.apple.com/kb/HT211294 (Vendor Advisory)
support.apple.com/kb/HT211295 (Vendor Advisory)
support.apple.com/kb/HT211931 (Vendor Advisory)
www.zerodayinitiative.com/advisories/ZDI-20-1389/ (VDB Entry, Third Party Advisory)
seclists.org/fulldisclosure/2020/Dec/32 (mailing-list, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2020-9883?: CVE-2020-9883 is a high-severity vulnerability in Apple Icloud, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.8/10. Published 2020-10-22.
How severe is CVE-2020-9883?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2020-9883 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.