Search for vulnerabilities
Vulnerability details: VCID-28h7-92ca-9yc1
Vulnerability ID VCID-28h7-92ca-9yc1
Aliases CVE-2019-8506
Summary A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
Status Published
Exploitability 2.0
Weighted Severity 8.4
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
CWE-94 Improper Control of Generation of Code ('Code Injection')
System Score Found at
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-8506.json
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16048 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
cvssv2 9.3 https://nvd.nist.gov/vuln/detail/CVE-2019-8506
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2019-8506
cvssv3.1 8.8 https://support.apple.com/HT209599
ssvc Attend https://support.apple.com/HT209599
cvssv3.1 8.8 https://support.apple.com/HT209601
ssvc Attend https://support.apple.com/HT209601
cvssv3.1 8.8 https://support.apple.com/HT209602
ssvc Attend https://support.apple.com/HT209602
cvssv3.1 8.8 https://support.apple.com/HT209603
ssvc Attend https://support.apple.com/HT209603
cvssv3.1 8.8 https://support.apple.com/HT209604
ssvc Attend https://support.apple.com/HT209604
cvssv3.1 8.8 https://support.apple.com/HT209605
ssvc Attend https://support.apple.com/HT209605
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-8506.json
https://api.first.org/data/v1/epss?cve=CVE-2019-8506
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8506
1719199 https://bugzilla.redhat.com/show_bug.cgi?id=1719199
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
CVE-2019-8506 Exploit https://bugs.chromium.org/p/project-zero/issues/detail?id=1753
CVE-2019-8506 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/dos/46647.js
CVE-2019-8506 https://nvd.nist.gov/vuln/detail/CVE-2019-8506
HT209599 https://support.apple.com/HT209599
HT209601 https://support.apple.com/HT209601
HT209602 https://support.apple.com/HT209602
HT209603 https://support.apple.com/HT209603
HT209604 https://support.apple.com/HT209604
HT209605 https://support.apple.com/HT209605
RHSA-2019:3553 https://access.redhat.com/errata/RHSA-2019:3553
RHSA-2020:4035 https://access.redhat.com/errata/RHSA-2020:4035
USN-3948-1 https://usn.ubuntu.com/3948-1/
Data source Exploit-DB
Date added April 3, 2019
Description WebKit JavaScriptCore - 'createRegExpMatchesArray' Type Confusion
Ransomware campaign use Known
Source publication date April 3, 2019
Exploit type dos
Platform multiple
Source update date April 3, 2019
Source URL https://bugs.chromium.org/p/project-zero/issues/detail?id=1753
Data source KEV
Date added May 4, 2022
Description A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Required action Apply updates per vendor instructions.
Due date May 25, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2019-8506
Ransomware campaign use Unknown
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-8506.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2019-8506
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-8506
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209599
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209599
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209601
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209601
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209602
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209602
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209603
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209603
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209604
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209604
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209605
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209605
Exploit Prediction Scoring System (EPSS)
Percentile 0.94505
EPSS Score 0.16048
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:29:57.436583+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.9/community.json 37.0.0