CVE-2019-7286KEV · OVERDUE

Apple Multiple Products Memory Corruption Vulnerability

High · published December 18, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 96.9th percentile for exploit probability.

1593
days past CISA
deadline
CVSS v3.1
7.8
EPSS
16%
Percentile
96.9
In the wild
Confirmed
What it is

⚡ A memory corruption vulnerability could let a rogue application hijack your device’s privileges! 🚨 Think of it like a sneaky waiter who finds a way to access the kitchen and start serving up whatever they want, from behind the scenes. Without proper checks, they can take over and run the show! An attacker exploiting this vulnerability could gain elevated privileges, potentially allowing them to execute malicious code or access sensitive information. This situation is absolutely devastating — your device could be compromised without your knowledge! 🔥

Put simply

Think of it like a sneaky waiter who finds a way to access the kitchen and start serving up whatever they want, from behind the scenes. Without proper checks, they can take over and run the show! This memory corruption issue arises from improper input validation, which allows an application to potentially gain elevated privileges on affected devices, including iOS and macOS systems.

What to do

An attacker exploiting this vulnerability could gain elevated privileges, potentially allowing them to execute malicious code or access sensitive information. This situation is absolutely devastating — your device could be compromised without your knowledge! 🔥 Update your devices immediately to iOS 12.1.4 and macOS Mojave 10.14.3 to patch this vulnerability. Regularly review your installed applications and ensure they're from trusted sources. 🛡️ You’ve got this! Update your devices and secure those privileges! ✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.15939 · 96.9th percentile
Published
2019-12-18T17:33Z
KEV added
2022-05-23 · due 2022-06-13
EPSS history
Timeline
  • 23 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 13
    kev
  • 18 DEC 17:33Z
    A memory corruption issue was addressed with improved input validation
    cvelistv5