CVE-2019-7287

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Apple	iOS	>= unspecified, < iOS 12.1.4

References

https://support.apple.com/HT209520Release Notes, Vendor Advisory
https://support.apple.com/HT209520Release Notes, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7287US Government Resource

Timeline

Published: Dec 18, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: May 23, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-72889.8The issue was addressed with improved validation on the FaceTime server. This issue is fixed in macOS Mojave 10.14.3 Supplemental Update, iO CVE-2019-72895.5A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Shortcuts 2.1.3 for i CVE-2019-729010.0An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A sandboxed process may CVE-2019-72916.5A denial of service issue was addressed with improved memory handling. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, Ai CVE-2019-72926.5A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 fo CVE-2019-72935.5A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, wat CVE-2019-72956.1typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula.CVE-2019-72966.1typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula.CVE-2019-72979.8An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to exec CVE-2019-72988.1An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to exec CVE-2019-72996.1A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1 CVE-2019-73007.2Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and