ByteOS

Product:iOS, iPadOS, and watchOS

Added At:03 Nov, 2021

Due At:03 May, 2022

Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability

Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.

Used in Ransomware

Unknown

CWE

CWE-787

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2020-9818

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:apple

Assigner Org ID:286789f9-fbc2-4510-9f9a-43facdede74c

Published At:09 Jun, 2020 | 16:12

Updated At:20 Aug, 2025 | 03:56

▼CVE Numbering Authority (CNA)

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.

Affected Products

Vendor

Product

iOS

Versions

Affected

From unspecified before iOS 13.5 and iPadOS 13.5 (custom)

Vendor

Product

iOS-1

Versions

Affected

From unspecified before iOS 12.4.7 (custom)

Vendor

Product

watchOS

Versions

Affected

From unspecified before watchOS 6.2.5 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination

Type: text

CWE ID: N/A

Description: Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination

References

Hyperlink	Resource
https://support.apple.com/HT211168	x_refsource_MISC
https://support.apple.com/HT211175	x_refsource_MISC
https://support.apple.com/HT211169	x_refsource_MISC

Hyperlink: https://support.apple.com/HT211168

Resource:

x_refsource_MISC

Hyperlink: https://support.apple.com/HT211175

Resource:

x_refsource_MISC

Hyperlink: https://support.apple.com/HT211169

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://support.apple.com/HT211168	x_refsource_MISC x_transferred
https://support.apple.com/HT211175	x_refsource_MISC x_transferred
https://support.apple.com/HT211169	x_refsource_MISC x_transferred

Hyperlink: https://support.apple.com/HT211168

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://support.apple.com/HT211175

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://support.apple.com/HT211169

Resource:

x_refsource_MISC

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-787	CWE-787 Out-of-bounds Write

Type: CWE

CWE ID: CWE-787

Description: CWE-787 Out-of-bounds Write

Metrics

Version	Base score	Base severity	Vector
3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2021-11-03

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9818

Timeline

Event	Date
CVE-2020-9818 added to CISA KEV	2021-11-03 00:00:00

Event: CVE-2020-9818 added to CISA KEV

Date: 2021-11-03 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:09 Jun, 2020 | 17:15

Updated At:28 Feb, 2025 | 14:44

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2021-11-03	2022-05-03	Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability	Apply updates per vendor instructions.

Date Added: 2021-11-03

Due Date: 2022-05-03

Vulnerability Name: Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

>>ipados>>Versions before 13.5(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions before 12.4.7(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions from 13.0(inclusive) to 13.5(exclusive)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

>>watchos>>Versions before 6.2.5(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-787	Primary	nvd@nist.gov
CWE-787	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-787

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-787

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://support.apple.com/HT211168	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/HT211169	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/HT211175	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/HT211168	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://support.apple.com/HT211169	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://support.apple.com/HT211175	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory

Hyperlink: https://support.apple.com/HT211168

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/HT211169

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/HT211175

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/HT211168

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/HT211169

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/HT211175

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Release Notes

Vendor Advisory

Similar CVEs

5203Records found

CVE-2018-4935

Matching Score-10

Matching Score-10

Product-linux_kernel windows_8.1 chrome_os mac_os_x windows flash_player_desktop_runtime windows_10 flash_player Adobe Flash Player 29.0.0.113 and earlier versions

CVSS Score-8.8||HIGH

EPSS-45.21% / 97.51%

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 05:18

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vendor-n/a Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-42917

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.04% / 9.75%

7 Day CHG-0.00%

Published-30 Nov, 2023 | 22:18

Updated-30 Jul, 2025 | 01:37

Known KEV||Action Due Date - 2023-12-25||Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Vendor-webkitgtk Apple Inc.Debian GNU/Linux Fedora Project

Product-fedora debian_linux safari ipados webkitgtk\+macos iphone_os Safari iOS and iPadOS macOS Multiple Products

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-39843

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-31.33% / 96.61%

7 Day CHG~0.00%

Published-29 Sep, 2021 | 15:38

Updated-17 Sep, 2024 | 01:51

Adobe Acrobat Reader XObject Out-of-Bound Write Vulnerability

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-40731

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-5.76% / 90.12%

7 Day CHG~0.00%

Published-15 Oct, 2021 | 14:22

Updated-23 Apr, 2025 | 19:24

Adobe Acrobat Reader DC JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by an out-of-bounds write vulnerability when parsing a crafted JPEG2000 file, which could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-42910

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.13% / 33.70%

7 Day CHG~0.00%

Published-12 Dec, 2023 | 00:27

Updated-13 Feb, 2025 | 17:13

Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8739

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.42% / 60.99%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-xcode Xcode

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8835

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.57% / 67.63%

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:53

Updated-04 Aug, 2024 | 21:31

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.

Product-enterprise_linux_server itunes iphone_os ipados tvos safari enterprise_linux_workstation enterprise_linux_desktop icloud iTunes for Windows iCloud for Windows Safari tvOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-39820

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-4.67% / 88.90%

7 Day CHG~0.00%

Published-15 Jun, 2022 | 16:53

Updated-23 Apr, 2025 | 18:15

Adobe InDesign Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution

Adobe InDesign versions 16.3 (and earlier), and 16.3.1 (and earlier) is affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious TIFF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-windows indesign macos InDesign

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8686

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.82% / 73.39%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iCloud for Windows (Microsoft Store)iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-416

Use After Free

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-5029

Matching Score-10

Assigner-Chrome

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation libxml2 (XMLSoft)Debian GNU/Linux Red Hat, Inc.

Matching Score-10

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-2.66% / 85.20%

7 Day CHG~0.00%

Published-24 Apr, 2017 | 23:00

Updated-20 Apr, 2025 | 01:37

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

Product-chrome enterprise_linux_desktop enterprise_linux_workstation linux_kernel windows debian_linux enterprise_linux_server libxslt macos android Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for Android

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3099

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-1.86% / 82.30%

7 Day CHG~0.00%

Published-14 Jul, 2017 | 05:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 26.0.0.131 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3074

Matching Score-10

Matching Score-10

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-1.97% / 82.78%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Graphics class. Successful exploitation could lead to arbitrary code execution.

Product-enterprise_linux_desktop chrome_os enterprise_linux_workstation linux_kernel flash_player_desktop_runtime windows_8.1 windows enterprise_linux windows_10 flash_player mac_os_x Adobe Flash Player 25.0.0.148 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3072

Matching Score-10

Matching Score-10

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-1.97% / 82.78%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3070

Matching Score-10

Matching Score-10

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-1.97% / 82.78%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the ConvolutionFilter class. Successful exploitation could lead to arbitrary code execution.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3068

Matching Score-10

Matching Score-10

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-38.10% / 97.12%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploitation could lead to arbitrary code execution.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2988

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-40.87% / 97.28%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2999

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-1.01% / 76.15%

7 Day CHG~0.00%

Published-14 Mar, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.221 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2930

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-73.56% / 98.75%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a display list. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-27943

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.43% / 61.88%

7 Day CHG~0.00%

Published-02 Apr, 2021 | 17:36

Updated-04 Aug, 2024 | 16:25

A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in tvOS 14.3, iOS 14.3 and iPadOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.2. Processing a maliciously crafted font file may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os ipad_os watchos tvos macos tvOS macOS watchOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2986

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-34.47% / 96.86%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (FLV) codec. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2990

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-1.24% / 78.45%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 decompression routine. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-39537

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.35% / 56.86%

7 Day CHG-0.05%

Published-20 Sep, 2021 | 00:00

Updated-04 Aug, 2024 | 02:06

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Vendor-n/a GNU Apple Inc.

Product-ncurses macos mac_os_x n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-32435

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.50% / 64.95%

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-30 Jul, 2025 | 01:37

Known KEV||Action Due Date - 2023-07-14||Apply updates per vendor instructions.

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

Vendor-Apple Inc.

Product-iphone_os macos safari ipados Safari iOS and iPadOS macOS Multiple Products

CWE ID-CWE-787

Out-of-bounds Write

CVE-2018-5045

Matching Score-10

Matching Score-10

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions

CVSS Score-8.8||HIGH

EPSS-13.66% / 93.99%

7 Day CHG~0.00%

Published-20 Jul, 2018 | 19:00

Updated-05 Aug, 2024 | 05:26

Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-23518

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.24% / 47.23%

7 Day CHG~0.00%

Published-27 Feb, 2023 | 00:00

Updated-11 Mar, 2025 | 16:15

The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-tvos macos iphone_os safari ipados watchos Safari watchOS macOS tvOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-43300

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.72% / 81.62%

7 Day CHG+0.81%

Published-21 Aug, 2025 | 00:27

Updated-26 Aug, 2025 | 14:47

Known KEV||Action Due Date - 2025-09-11||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sonoma 14.7.8, macOS Ventura 13.7.8, iPadOS 17.7.10, macOS Sequoia 15.6.1, iOS 18.6.2 and iPadOS 18.6.2. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Vendor-Apple Inc.

Product-ipados iphone_os macos iOS and iPadOS macOS iPadOS iOS, iPadOS, and macOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4151

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.13% / 88.19%

7 Day CHG+1.03%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4241

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-5.16% / 89.49%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4240

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.04% / 88.05%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-7873

Matching Score-10

Matching Score-10

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

CVSS Score-8.8||HIGH

EPSS-4.26% / 88.37%

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the PSDK class related to ad policy functionality method. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-6983

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-2.01% / 82.96%

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2020-10017

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.65% / 69.78%

7 Day CHG~0.00%

Published-08 Dec, 2020 | 20:06

Updated-04 Aug, 2024 | 10:50

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. Processing a maliciously crafted audio file may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados mac_os_x watchOS tvOS macOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4183

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.09% / 88.12%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4284

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-1.90% / 82.47%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4188

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.71% / 87.49%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4123

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-2.18% / 83.68%

7 Day CHG-0.01%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4154

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.13% / 88.19%

7 Day CHG+1.03%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4244

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-3.61% / 87.34%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4182

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-8.68% / 92.12%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4179

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-44.74% / 97.49%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4280

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-1.90% / 82.47%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4275

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-26.20% / 96.10%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4221

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-5.16% / 89.49%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-4220

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-5.16% / 89.49%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, and CVE-2016-4246.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8814

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.70% / 71.16%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.

Product-enterprise_linux_server itunes iphone_os ipados tvos safari enterprise_linux_workstation enterprise_linux_desktop icloud iTunes for Windows iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8766

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.55% / 66.85%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-icloud watchos watchOS iCloud for Windows

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8536

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.59% / 80.91%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

Product-enterprise_linux_server itunes iphone_os watchos tvos safari enterprise_linux_workstation enterprise_linux_desktop icloud iTunes for Windows watchOS Safari iCloud for Windows iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8622

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-27.09% / 96.20%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos tvos safari mac_os_x icloud iTunes for Windows watchOS Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8815

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.85% / 73.95%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8844

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-2.46% / 84.64%

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:55

Updated-04 Aug, 2024 | 21:31

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.