CVE-2020-29624 is a memory corruption vulnerability affecting Apple's iOS, iPadOS, macOS, tvOS, and watchOS operating systems, stemming from improper input validation when processing font files. A successful exploit, triggered by a maliciously crafted font file, could lead to arbitrary code execution on the affected device. Rated with a CVSS score of 7.8 (High), this vulnerability requires user interaction (UI:R) but has low attack complexity (AC:L) and no authentication required (PR:N), making it a significant risk if exploited. While no active exploitation, public exploit code, or significant community discussion has been observed, Apple has released patches in watchOS 7.2, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3, iPadOS 14.3, and tvOS 14.3.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 14.3CPE matchmatch criteria | cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | ||
< 14.3CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | ||
>= 10.14, < 10.14.6CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | ||
>= 10.15, < 10.15.7CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | ||
10.14.6CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.