CVE-2020-9934
Apple iOS, iPadOS, and macOS Input Validation Vulnerability
Published Oct 16, 2020 · updated Jun 16, 2026 · apple ipados
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
Timeline
Detection, updates, and resolution for this record.
Oct 16, 2020 · Catalog
Detected
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
Sep 8, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Sep 29, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
Required action
Apply updates per vendor instructions.
CISA due date Sep 29, 2022
Affected
- cpe apple/ipadosversion unspecified
- cpe apple/iphone osversion unspecified
- cpe apple/mac os xversion unspecified
- vendor Apple iOS, iPadOS, and macOSversion unspecified
Sources
- CISA KEVCVE-2020-9934
Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.
cisa.gov - CVE.orgCVE-2020-9934
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-9934
30-day exploitation probability 3.2%
first.org - Metasploit Modulespost_osx/escalate/tccbypass
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2020-9934
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
nvd.nist.gov