First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2019-8526

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Apple	macOS	>= unspecified, < macOS Mojave 10.14.4

References

https://support.apple.com/HT209600Release Notes, Vendor Advisory
https://support.apple.com/HT209600Release Notes, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8526US Government Resource

Timeline

Published: Dec 18, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 17, 2023
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-85279.1A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2 CVE-2019-85286.7A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 5.2, macOS Mojave 10.14.4, Security Upd CVE-2019-85297.8A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. An applicatio CVE-2019-85305.5This issue was addressed with improved checks. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. A malicious application may CVE-2019-85319.8A validation issue existed in Trust Anchor Management. This issue was addressed with improved validation. This issue is fixed in watchOS 5.2 CVE-2019-85325.5A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in watchOS 5.2, iOS 12.2. A CVE-2019-85337.8A lock handling issue was addressed with improved lock handling. This issue is fixed in macOS Mojave 10.14.4. A Mac may not lock when discon CVE-2019-85346.7A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Mojave CVE-2019-85358.8A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9 CVE-2019-85368.8A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1,CVE-2019-85375.5An access issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to view CVE-2019-85385.5A denial of service issue was addressed with improved validation. This issue is fixed in watchOS 5.2, macOS Mojave 10.14.4, Security Update