CVE-2018-4386

HIGH EXPLOITED

Safari < 12.0.1 - Memory Corruption

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-4386 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including Google Security Research, TJ Corley, a0zhar.

AI-analyzed exploit summary This PoC exploits a JavaScript engine vulnerability in WebKit (CVE-2018-4386) where hoisting a function overwrites the iteration variable in a for-in loop, leading to type confusion. The arbitrary object passed to op_get_direct_pname can cause memory corruption or RCE.

Description

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Google Security Research · javascriptdosmultiple
https://www.exploit-db.com/exploits/45912

This PoC exploits a JavaScript engine vulnerability in WebKit (CVE-2018-4386) where hoisting a function overwrites the iteration variable in a for-in loop, leading to type confusion. The arbitrary object passed to op_get_direct_pname can cause memory corruption or RCE.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WebKit (Safari) versions prior to fix
No auth needed
Prerequisites: Victim must visit a malicious webpage or execute the script in a vulnerable WebKit-based browser
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by TJ Corley · javascriptwebappshardware
https://www.exploit-db.com/exploits/47893

This exploit leverages CVE-2018-4386, a type confusion vulnerability in WebKit, to achieve arbitrary read/write primitives on PS4 firmware 6.XX. It sprays structures, triggers the bug, and sets up fake objects for memory manipulation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: WebKit on PS4 firmware 6.XX
No auth needed
Prerequisites: PS4 on vulnerable firmware (6.XX) · WebKit-based browser context
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by a0zhar · poc
https://github.com/a0zhar/Bad_Hoist-WriteUp

This is a detailed writeup explaining the exploitation of CVE-2018-4386, a type confusion vulnerability in WebKit's JavaScriptCore engine affecting PS4 firmware 6.XX. It describes the logic flaw in variable hoisting within `for-in` loops and how it leads to arbitrary read/write primitives.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: PlayStation 4 WebKit (v605.1.15) on firmware 6.XX
No auth needed
Prerequisites: Access to PS4 web browser · PS4 firmware 6.XX
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT209192
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT209195
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT209194
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT209197
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT209198
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT209196

Scores

CVSS v3 8.8
EPSS 0.0646
EPSS Percentile 93.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2024-05-06
CWE
CWE-119
Status published
Products (6)
apple/icloud < 7.8
apple/iphone_os < 12.1
apple/itunes < 12.9.1
apple/safari < 12.0.1
apple/tvos < 12.1
apple/watchos < 5.1
Published Apr 03, 2019
Tracked Since Feb 18, 2026