Actively exploited · Published Dec 18, 2019 · Assigned by apple

CVE-2019-8605

High 7.8 Exploited

In plain English

A high-severity use-after-free in iOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on June 27, 2022). The chance it is exploited in the next 30 days is estimated at 17.6% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)17.6%top 2.8% of all CVEs

Exploited in the wildYesCISA KEV since Jun 27, 2022

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jul 18, 2022.

Official description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.

Affected products (as reported)

Vendor	Product	Versions
Apple	iOS	unspecified – before iOS 12.3
Apple	macOS	unspecified – before macOS Mojave 10.14.5
Apple	tvOS	unspecified – before tvOS 12.3
Apple	watchOS	unspecified – before watchOS 5.2.1

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://support.apple.com/HT210118 x_refsource_MISC
https://support.apple.com/HT210119 x_refsource_MISC
https://support.apple.com/HT210120 x_refsource_MISC
https://support.apple.com/HT210122 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8605 government-resource