CVE-2019-7286

HIGH KEV

iPhone OS < 12.1.4 and macOS < 10.14.3 - Out-of-bounds Write

Title source: llm

Exploitation Summary

CVE-2019-7286 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 23, 2022. EIP tracks 1 public exploit from researchers including ZecOps.

AI-analyzed exploit summary This exploit targets CVE-2019-7286, a heap overflow vulnerability in Apple's cfprefsd. It uses heap spraying and XPC message manipulation to achieve arbitrary code execution by corrupting Objective-C object structures.

Description

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.

Exploits (1)

exploitdb WORKING POC

by ZecOps · cdosios

https://www.exploit-db.com/exploits/46803

View Code ZIP pw:eip

This exploit targets CVE-2019-7286, a heap overflow vulnerability in Apple's cfprefsd. It uses heap spraying and XPC message manipulation to achieve arbitrary code execution by corrupting Objective-C object structures.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Complex

Reliability

Racy

Target: Apple cfprefsd (agent/daemon)

No auth needed

Prerequisites: macOS system with vulnerable cfprefsd version

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Core References

Vendor Advisory x_refsource_misc

https://support.apple.com/HT209601

Vendor Advisory x_refsource_misc

https://support.apple.com/HT209602

Vendor Advisory x_refsource_misc

https://support.apple.com/HT209520

Vendor Advisory x_refsource_misc

https://support.apple.com/HT209521

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7286

Scores

CVSS v3 7.8

EPSS 0.0158

EPSS Percentile 82.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable no

Technical Impact total

Details

CISA KEV 2022-05-23

VulnCheck KEV 2019-02-07

InTheWild.io 2019-02-07

ENISA EUVD EUVD-2019-16830

CWE

CWE-787

Status published

Products (2)

apple/iphone_os < 12.1.4

apple/mac_os_x < 10.14.3

Published Dec 18, 2019

KEV Added May 23, 2022

Tracked Since Feb 18, 2026