Apple · iOS
CVE-2019-7287
Apple iOS Memory Corruption Vulnerability
Exploited in attacks
High 7.8 Attack chance: 4.6%
What it is
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.
CISA: Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 13, 2022
- Added to the CISA list
- May 23, 2022
- Published
- December 18, 2019
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 4.6% in the top 8.4% of all known vulnerabilities
- Weakness
- CWE-787
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 14, 2022 | Type Confusion | iOS | High 8.8 | 8.5% |
| May 24, 2022 | Information Disclosure | iOS | Medium 5.5 | 33% |
| May 24, 2022 | Memory Corruption | iOS | High 7.8 | 24% |
| May 24, 2022 | Webkit Memory Corruption | iOS | High 8.8 | 67% |
| Nov 3, 2021 | WebKit Buffer Overflow | iOS | High 8.8 | 3.0% |
| Nov 3, 2021 | WebKit Memory Corruption | iOS | High 8.8 | 11% |
| Nov 3, 2021 | WebKit Use-After-Free | iOS | High 8.8 | 11% |
| Sep 29, 2026 | Out-of-Bounds Write | Multiple Products | High 8.8 | 26% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.