CVE-2019-8526KEV · OVERDUE

Apple macOS Use-After-Free Vulnerability

High · published December 18, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 52.7th percentile for exploit probability.

1264
days past CISA
deadline
CVSS v3.1
7.8
EPSS
1%
Percentile
52.7
In the wild
Confirmed
What it is

🚨 A crafty app could seize control of your Mac with just a slip in memory management! ⚡ Think of it like a waiter who accidentally serves a dish that wasn’t ordered, leaving the customer with a chance to take over the kitchen—if the waiter doesn't double-check the orders first! An attacker could exploit this vulnerability, gaining elevated privileges and causing absolute chaos—think unauthorized access to sensitive files, installation of malicious software, or even complete control of your system. This is not just a minor inconvenience; it could lead to devastating data breaches and loss of privacy.

Put simply

Think of it like a waiter who accidentally serves a dish that wasn’t ordered, leaving the customer with a chance to take over the kitchen—if the waiter doesn't double-check the orders first! This use-after-free vulnerability occurs when an application continues to use memory after it has been freed, allowing an attacker to manipulate that memory in a way that gains elevated privileges.

What to do

An attacker could exploit this vulnerability, gaining elevated privileges and causing absolute chaos—think unauthorized access to sensitive files, installation of malicious software, or even complete control of your system. This is not just a minor inconvenience; it could lead to devastating data breaches and loss of privacy. To protect yourself, upgrade your system to macOS Mojave 10.14.4 or later immediately. Also, ensure that all your applications are up to date and monitor for unusual behaviors on your device. You've got this! Following these steps will help keep your Mac secure and sound! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00701 · 52.7th percentile
Published
2019-12-18T17:33Z
KEV added
2023-04-17 · due 2023-05-08
EPSS history
Timeline
  • 17 APR 00:00Z
    Added to CISA KEV — remediate by May 8
    kev
  • 18 DEC 17:33Z
    A use after free issue was addressed with improved memory management
    cvelistv5