CVE-2020-27923: 
macOS vulnerability analysis and mitigation

CVE-2020-27923 is an out-of-bounds write vulnerability that was discovered in Apple's ImageIO component. The vulnerability was fixed in multiple Apple operating systems including macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, and tvOS 14.2. The vulnerability was discovered by Lei Sun (Apple Advisory).

The vulnerability is classified as an out-of-bounds write issue in the ImageIO component that was addressed with improved input validation. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

When exploited, processing a maliciously crafted image may lead to arbitrary code execution on the affected system. This could allow an attacker to execute malicious code with the privileges of the user running the application (Apple Advisory).

Apple has addressed this vulnerability by implementing improved input validation in the affected operating systems. Users should update to macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, or tvOS 14.2 depending on their device (Apple Advisory).