CVE-2019-8607
Status: ModifiedMedium (6.5)—
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may result in the disclosure of process memory.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Base score: 6.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.65%
- Percentile among all scored CVEs: 76
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (7)
CWEs
- CWE-125
References
- https://support.apple.com/HT210118
- https://support.apple.com/HT210119
- https://support.apple.com/HT210120
- https://support.apple.com/HT210122
- https://support.apple.com/HT210123
- https://support.apple.com/HT210124
- https://support.apple.com/HT210125
- https://support.apple.com/HT210212
- https://support.apple.com/HT210118
- https://support.apple.com/HT210119
- https://support.apple.com/HT210120
- https://support.apple.com/HT210122
- https://support.apple.com/HT210123
- https://support.apple.com/HT210124
- https://support.apple.com/HT210125
- https://support.apple.com/HT210212
Raw JSON (NVD)
Show
{
"id": "CVE-2019-8607",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "product-security@apple.com",
"affectedData": [
{
"vendor": "Apple",
"product": "iOS",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "iOS 12.3",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "macOS",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "macOS Mojave 10.14.5",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "tvOS",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "tvOS 12.3",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "watchOS",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "watchOS 5.2.1",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "Safari",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "Safari 12.1.1",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "iTunes for Windows",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "iTunes for Windows 12.9.5",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "iCloud for Windows",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "iCloud for Windows 7.12",
"versionType": "custom"
}
]
}
]
}
],
"published": "2019-12-18T18:15:28.990",
"references": [
{
"url": "https://support.apple.com/HT210118",
"tags": [
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT210119",
"tags": [
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT210120",
"tags": [
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT210122",
"tags": [
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT210123",
"tags": [
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT210124",
"tags": [
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT210125",
"tags": [
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT210212",
"tags": [
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT210118",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/HT210119",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/HT210120",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/HT210122",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/HT210123",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/HT210124",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/HT210125",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/HT210212",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may result in the disclosure of process memory."
},
{
"lang": "es",
"value": "Una lectura fuera de límites fue abordada con una comprobación de entrada mejorada. Este problema es corregido en iOS versión 12.3, macOS Mojave versión 10.14.5, tvOS versión 12.3, watchOS versión 5.2.1, Safari 12.1.1, iTunes para Windows versión 12.9.5, iCloud para Windows versión 7.12. El procesamiento de contenido web diseñado maliciosamente puede conllevar a una divulgación de la memoria de proceso."
}
],
"lastModified": "2026-06-17T02:42:14.830",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "94D4BA69-CF5D-4F94-A78E-4D642A166704",
"versionEndExcluding": "7.12"
},
{
"criteria": "cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "523206B0-7C1A-4442-9888-525A2FFFAFD9",
"versionEndExcluding": "10.4",
"versionStartIncluding": "10.0"
},
{
"criteria": "cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "F07EF362-5B81-4A7E-A4BD-C32B6ABE46ED",
"versionEndExcluding": "12.9.5"
},
{
"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3711102B-4DA7-4212-A741-1EFE87D60A95",
"versionEndExcluding": "12.1.1"
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB19F7E8-75CA-4F9F-B79C-DB3B2C0E1EF4",
"versionEndExcluding": "12.3"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6E2DF4C-D103-4762-8CF1-6EDCE088FB1A",
"versionEndExcluding": "10.14.5"
},
{
"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4F48137-53D0-4469-9785-57A7FC4482AB",
"versionEndExcluding": "12.3"
},
{
"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF31F5E0-94DD-41FD-80D4-8A27CAECB80B",
"versionEndExcluding": "5.2.1"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "product-security@apple.com"
}