Multiple memory corruption issues were addressed with improved memory handling.

Published 6 y ago 2019-12-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

2.0%

percentile 81%

Public exploits

none known

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Exploit prediction (EPSS)

1.99% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

Apple iOS
Apple macOS
Apple tvOS
Apple Safari
Apple iTunes for Windows
Apple iCloud for Windows

Classification

Weakness

CWE-787 Out-of-bounds Write

References

support.apple.com /HT210118 · x_refsource_MISC, x_transferred
support.apple.com /HT210119 · x_refsource_MISC, x_transferred
support.apple.com /HT210120 · x_refsource_MISC, x_transferred
support.apple.com /HT210123 · x_refsource_MISC, x_transferred
support.apple.com /HT210124 · x_refsource_MISC, x_transferred
support.apple.com /HT210125 · x_refsource_MISC, x_transferred
support.apple.com /HT210212 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2019-8596
NVD: CVE-2019-8596

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.