CVE-2019-7287highunder attackCWE-787

CVE-2019-7287: high-severity vulnerability in Apple iOS

Published · Updated

Follow this CVE+ Monitor iOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 4.6%
from disclosure to weapon
Published on NVDDec 18
CISA KEV+887d
Action required by CISAfederal deadline: 2022-06-13

Apply updates per vendor instructions.

In short

A flaw in iOS 12.1.4 allows an app to run malicious code with the highest system privileges, potentially taking complete control of your device. This happens because the system didn't properly validate certain inputs before using them.

Technical detail

Memory corruption vulnerability in iOS 12.1.4 (CWE-787: out-of-bounds write) allowing arbitrary code execution with kernel privileges. Exploitation requires a malicious app with no special permissions; the vulnerability is triggered through improper input validation during memory operations.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iOS
Related CVEs — Apple iOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2019-8605HIGHCVE-2019-8605EPSS 17.6%KEVCVE-2019-8506HIGHCVE-2019-8506EPSS 16.2%KEVCVE-2019-7286HIGHCVE-2019-7286EPSS 15.9%KEVCVE-2020-3837HIGHCVE-2020-3837EPSS 14.8%KEVCVE-2021-30858HIGHCVE-2021-30858EPSS 13.4%KEV