CVE-2019-6223

CVE-2019-6223 is a high-severity (CVSS 7.5) vulnerability in Apple iOS and macOS. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 3, 2022. CISA does not currently list it as used in ransomware campaigns. Apple has 95 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• https://support.apple.com/HT209520
• https://support.apple.com/HT209521
• https://support.apple.com/HT209520
• https://support.apple.com/HT209521
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6223