$ cve CVE-2018-4218 JSON

CVE-2018-4218 EXPLOIT

8.8

HIGH · CVSS 3.0 · EPSS 9% (pctl 95)

Patch early

A public exploit exists.

Description

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers an @generatorState use-after-free.

Scoring

CVSS	8.8 (HIGH, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS	8.96% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-416
On CISA KEV	no
Public exploit	yes
Published	2018-06-08
Last modified	2026-06-17

Affected (8)

Vendor	Product
apple	icloud
apple	iphone os
apple	itunes
apple	safari
apple	tvos
apple	watchos
canonical	ubuntu linux
microsoft	windows

Public exploits

Source	Title	Date
exploit-db	WebKit - Use-After-Free when Resuming Generator	2018-06-08

References

→ the Explorer · watch your stack · NVD