CVE-2018-4386 EXPLOIT
8.8
HIGH · CVSS 3.0 · EPSS 6.5% (pctl 94)
Patch early
A public exploit exists.
Description
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Scoring
| CVSS | 8.8 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 6.49% — more likely to be exploited than 94% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2019-04-03 |
| Last modified | 2026-06-17 |
Affected (7)
| Vendor | Product |
|---|---|
| apple | icloud |
| apple | iphone os |
| apple | itunes |
| apple | safari |
| apple | tvos |
| apple | watchos |
| microsoft | windows |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Sony Playstation 4 (PS4) < 6.72 - WebKit Code Execution (PoC) | 2019-12-31 |
| exploit-db | WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object | 2018-11-29 |
References
- http://packetstormsecurity.com/files/155871/Sony-Playstation-4-Webkit-Code-Execution.html
- https://support.apple.com/kb/HT209192
- https://support.apple.com/kb/HT209194
- https://support.apple.com/kb/HT209195
- https://support.apple.com/kb/HT209196
- https://support.apple.com/kb/HT209197
- https://support.apple.com/kb/HT209198
- http://packetstormsecurity.com/files/155871/Sony-Playstation-4-Webkit-Code-Execution.html
- https://support.apple.com/kb/HT209192
- https://support.apple.com/kb/HT209194
- https://support.apple.com/kb/HT209195
- https://support.apple.com/kb/HT209196
- https://support.apple.com/kb/HT209197
- https://support.apple.com/kb/HT209198
→ the Explorer · watch your stack · NVD