EXPOSURES › CVE-2020-27930
CVE-2020-27930
HIGH ⌖ ON CISA KEV · EXPLOITEDApple's FontParser memory corruption flaw in iOS, iPadOS, macOS, and watchOS allowed remote code execution when processing malicious fonts.
A memory corruption vulnerability in Apple's FontParser component across multiple operating systems enabled remote code execution via maliciously crafted font files. DIB organizations must ensure all Apple devices are patched immediately, as this flaw was actively exploited in the wild and represents a significant supply-chain and endpoint exposure risk. Failure to patch leaves systems vulnerable to ransomware and data breaches.
Shame score — A critical memory corruption flaw in a core system component was actively exploited in the wild, indicating a failure to patch a known vulnerability before widespread exploitation.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front.
"Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front."
"A man on the 'Today' show set slipped past security and allegedly lunged at anchor Craig Melvin."
"Police arrest man who shouted racial slur at 'TODAY' co-anchor Craig Melvin"
"Database CVE, CWE, CISA KEV & Vulnerability Intelligence | CVE Find"
"Crazed man lunged at 'Today' show star Craig Melvin, hurled racial slurs in terrifying security breach"