CVE-2019-7286

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Apple	iOS	>= unspecified, < iOS 12.1.4
Apple	macOS	>= unspecified, < macOS Mojave 10.14.3 Supplemental Update

References

https://support.apple.com/HT209520Vendor Advisory
https://support.apple.com/HT209521Vendor Advisory
https://support.apple.com/HT209601Vendor Advisory
https://support.apple.com/HT209602Vendor Advisory
https://support.apple.com/HT209520Vendor Advisory
https://support.apple.com/HT209521Vendor Advisory
https://support.apple.com/HT209601Vendor Advisory
https://support.apple.com/HT209602Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7286US Government Resource

Timeline

Published: Dec 18, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: May 23, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-72877.8A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to exe CVE-2019-72889.8The issue was addressed with improved validation on the FaceTime server. This issue is fixed in macOS Mojave 10.14.3 Supplemental Update, iO CVE-2019-72895.5A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Shortcuts 2.1.3 for i CVE-2019-729010.0An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A sandboxed process may CVE-2019-72916.5A denial of service issue was addressed with improved memory handling. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, Ai CVE-2019-72926.5A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 fo CVE-2019-72935.5A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, wat CVE-2019-72956.1typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula.CVE-2019-72966.1typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula.CVE-2019-72979.8An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to exec CVE-2019-72988.1An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to exec CVE-2019-72996.1A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1