CVE-2019-8605KEV · OVERDUE

Apple Multiple Products Use-After-Free Vulnerability

High · published December 18, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 97.1th percentile for exploit probability.

1558
days past CISA
deadline
CVSS v3.1
7.8
EPSS
18%
Percentile
97.1
In the wild
Confirmed
What it is

⚡ A crafty app could exploit a careless memory issue to execute code with system privileges – that's a security double whammy! 🔥 Think of this as leaving the back door of your house wide open while you go on vacation. An intruder could sneak in and do whatever they want without you ever knowing — a recipe for disaster! An attacker could run malicious code on your device as if they were you, accessing sensitive data, altering system settings, or causing chaos throughout your device. The potential for data breaches and unauthorized actions makes this a serious threat to your privacy and security.

Put simply

Think of this as leaving the back door of your house wide open while you go on vacation. An intruder could sneak in and do whatever they want without you ever knowing — a recipe for disaster! This vulnerability is a use-after-free issue, meaning that the application continues to use memory that has already been freed, which can be manipulated to execute arbitrary code with system privileges. An attacker could take advantage of this flaw in malicious applications.

What to do

An attacker could run malicious code on your device as if they were you, accessing sensitive data, altering system settings, or causing chaos throughout your device. The potential for data breaches and unauthorized actions makes this a serious threat to your privacy and security. Update your devices to iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, or watchOS 5.2.1 to patch this vulnerability immediately. Regularly check for updates and avoid installing unverified applications to minimize risk. You've got this! Stay vigilant and keep your devices updated to thwart those sneaky threats! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.17609 · 97.1th percentile
Published
2019-12-18T17:33Z
KEV added
2022-06-27 · due 2022-07-18
EPSS history
Timeline
  • 27 JUN 00:00Z
    Added to CISA KEV — remediate by Jul 18
    kev
  • 18 DEC 17:33Z
    A use after free issue was addressed with improved memory management
    cvelistv5