Actively exploited · Published Dec 18, 2019 · Assigned by apple
CVE-2019-7287
High 7.8 Exploited
In plain English
A high-severity out-of-bounds write in iOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on May 23, 2022). The chance it is exploited in the next 30 days is estimated at 4.6% (higher than 92% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)4.6%top 8.3% of all CVEs
Exploited in the wildYesCISA KEV since May 23, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 13, 2022.
Official description
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/HT209520 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7287 government-resource