$ cve CVE-2019-8623 JSON

CVE-2019-8623 EXPLOIT

8.8

HIGH · CVSS 3.1 · EPSS 8.3% (pctl 95)

Patch early

A public exploit exists.

Description

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Scoring

CVSS	8.8 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS	8.29% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-787
On CISA KEV	no
Public exploit	yes
Published	2019-12-18
Last modified	2026-06-17

Affected (7)

Vendor	Product
apple	icloud
apple	iphone os
apple	itunes
apple	mac os x
apple	safari
apple	tvos
apple	watchos

Public exploits

Source	Title	Date
exploit-db	Apple macOS < 10.14.5 / iOS < 12.3 JavaScriptCore - Loop-Invariant Code Motion (LICM) in DFG JIT Leaves Stack Variable Uninitialized	2019-05-21

References

→ the Explorer · watch your stack · NVD