CVE-2019-8526

Apple macOS: Use-After-Free

As of , CVE-2019-8526 in Apple macOS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.

Exploited
Yes: CISA listed it on 17 April 2023
US federal deadline
8 May 202321 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.01Higher than 51% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.00 on 17 April 2023EPSS on the day CISA listed it.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
Vendor advice: support.apple.comLinks below, from CISA's entry.

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.

CISA's description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.

The CVE record's description, from apple

CVE published
18 December 2019
Assigned by
apple
CVSS
7.8 High (CVSS 3.1, from CISA-ADP)
CWE-416
Use After Free
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

macOS: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2026-65400Improper AuthenticationApple macOSPatch nowForensic triage required by CISA0.02
CVE-2021-30657UnspecifiedApple macOSPatch this weekMetasploit module; EPSS 0.690.69
CVE-2022-22675Out-of-Bounds WriteApple macOSPatch soon0.12
CVE-2021-30713UnspecifiedApple macOSPatch soon0.07
CVE-2022-22674Out-of-Bounds ReadApple macOSPatch soon0.01

Read further