Actively exploited · Published Dec 18, 2019 · Assigned by apple
CVE-2019-7286
High 7.8 Exploited
In plain English
A high-severity out-of-bounds write in iOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on May 23, 2022). The chance it is exploited in the next 30 days is estimated at 15.9% (higher than 97% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)15.9%top 3.1% of all CVEs
Exploited in the wildYesCISA KEV since May 23, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 13, 2022.
Official description
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/HT209601 x_refsource_MISC
- https://support.apple.com/HT209602 x_refsource_MISC
- https://support.apple.com/HT209520 x_refsource_MISC
- https://support.apple.com/HT209521 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7286 government-resource