CVE-2019-7286
Published 2019-12-18 · Updated 2026-06-17 · Source product-security@apple.com
Summary
CVE-2019-7286 is a high-severity (CVSS 7.8) vulnerability in Apple Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalog on May 23, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 13, 2022. CISA does not currently list it as used in ransomware campaigns. Apple has 95 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 95 known-exploited Apple vulnerabilities →Description
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Apple — Multiple Products
Name: Apple Multiple Products Memory Corruption Vulnerability
Date added: 2022-05-23 · Due: 2022-06-13
Required action: Apply updates per vendor instructions.