CVE-2019-8605highunder attackCWE-416

CVE-2019-8605: high-severity vulnerability in Apple iOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor iOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

76Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 18%
from disclosure to weaponsame day
Published on NVDDec 18
1st PoCMay 21
CISA KEV+922d
Action required by CISAfederal deadline: 2022-07-18

Apply updates per vendor instructions.

In short

A program continues using memory after it has been freed, allowing a malicious app to run unauthorized code with system-level access. This happens because the system doesn't properly manage memory cleanup.

Technical detail

Use-after-free vulnerability in memory management allows a malicious application to execute arbitrary code with elevated system privileges. The vulnerability exists when freed memory is accessed without proper validation; exploitation requires local code execution capability on the affected system.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iOSApple · macOSApple · tvOSApple · watchOS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apple iOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV