CVE-2019-8662

—

CVSS 3.1

9.8 critical

EPSS

10%p95

Published

Dec 18, 2019 (Dec 18, 2019)

Modified

Jun 17, 2026

Description

This issue was addressed with improved checks. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary.

Vendors: apple
Products: iphone os, mac os x, tvos, watchos
Weakness: CWE-416, CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (9.8%)

In the news2 stories

Google Researchers Disclose PoCs for 4 Remotely Exploitable iOS Flaws

The Hacker NewsJul 30, 11:21 UTC · Jul 30, 2019Exploit / PoC CVE-2019-8641 CVE-2019-8646 CVE-2019-8647+3 CVEs

Google Project Zero hackers disclose PoCs for 4 iOS RCE flaws

Security AffairsJul 30, 13:24 UTC · Jul 30, 2019Vulnerability CVE-2019-8647 CVE-2019-8662 CVE-2019-8660+3 CVEs