CVE-2019-8646
HIGH EXPLOITED IN THE WILD RANSOMWAREiPhone OS < 12.4 - Out-of-bounds Read
Title source: llmExploitation Summary
CVE-2019-8646 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns. EIP tracks 1 public exploit from researchers including Google Security Research.
AI-analyzed exploit summary This exploit leverages a deserialization vulnerability in iOS's handling of _NSDataFileBackedFuture objects to perform out-of-bounds reads and leak memory from a remote device via iMessage. The PoC demonstrates file leakage by crafting malicious serialized objects that bypass URL scheme checks and exploit localization string handling.
Description
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote attacker may be able to leak memory.
Exploits (1)
This exploit leverages a deserialization vulnerability in iOS's handling of _NSDataFileBackedFuture objects to perform out-of-bounds reads and leak memory from a remote device via iMessage. The PoC demonstrates file leakage by crafting malicious serialized objects that bypass URL scheme checks and exploit localization string handling.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N