Loading vulnerability…
Use-after-free in Apple iOS, macOS, tvOS, and watchOS kernel
CVE-2019-8605 is a use-after-free vulnerability in Apple platforms that was fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, and watchOS 5.2.1. The flaw stems from improper memory management that can leave a freed object accessible after deallocation, enabling subsequent reuse of stale memory references. Apple indicated that a malicious application may be able to exploit the issue to execute arbitrary code with system privileges. Reporting also shows the vulnerability was used as the kernel stage of an iOS exploit chain, where it was combined with a Safari browser compromise to obtain root privileges on vulnerable devices.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary code execution in a highly privileged system or kernel context. On affected iOS devices, this can enable full device compromise, including elevation from an application or browser foothold to root-level control. In practical exploitation, this level of access supports installation of surveillance tooling, unrestricted access to protected device data, and execution of privileged post-exploitation actions.
If you can’t patch tonight, do this now.
Where immediate patching is not possible, reduce exposure by limiting installation and execution of untrusted applications, restricting use of vulnerable devices for high-risk browsing, and enforcing rapid OS update policies. Mobile device management controls, application allowlisting, and monitoring for signs of jailbreak-like privilege escalation activity can reduce risk, but these measures do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Apply the vendor fixes released in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, and watchOS 5.2.1 or later supported versions. Devices and systems running earlier vulnerable releases should be upgraded to a patched operating system version as the primary remediation.
1 exploit validated by Mallory's analysis. Hidden: 2 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.