CVE-2020-9890: 
macOS vulnerability analysis and mitigation

CVE-2020-9890 is an out-of-bounds read vulnerability discovered in Apple's audio processing components. The vulnerability was disclosed and patched in July 2020, affecting multiple Apple operating systems including iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, and watchOS 6.2.8. The vulnerability was discovered by JunDong Xie and XingWei Lin of Ant-Financial Light-Year Security Lab (Apple Advisory).

The vulnerability is classified as an out-of-bounds read issue in the audio processing component that was addressed with improved bounds checking. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

When exploited, processing a maliciously crafted audio file may lead to arbitrary code execution on the affected system. This could potentially allow an attacker to execute malicious code with the privileges of the audio processing component (Apple Advisory).

The vulnerability requires user interaction to process a maliciously crafted audio file. The attack requires local access to the system, with no privileges required, but does need user interaction to process the malicious file (NVD).

Apple has released security updates to address this vulnerability in iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, and watchOS 6.2.8. Users are advised to update their devices to these versions or later to mitigate the vulnerability (Apple Advisory).