Actively exploited · Published Dec 18, 2019 · Assigned by apple
CVE-2019-8526
High 7.8 Exploited
In plain English
A high-severity use-after-free in macOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on April 17, 2023). The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 46.6% of all CVEs
Exploited in the wildYesCISA KEV since Apr 17, 2023
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 8, 2023.
Official description
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://support.apple.com/HT209600 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8526 government-resource