CVE-2019-7287: Apple iOS memory corruption allows kernel code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and grants kernel-level code execution, though it requires local access and user interaction.

What it is

CVE-2019-7287 is an out-of-bounds write (CWE-787) in Apple iOS that was fixed in iOS 12.1.4 through improved input validation. A memory corruption flaw in the kernel means a malicious application can potentially run code with kernel privileges, which is the highest level of access on the device.

Impact

An attacker who can get a crafted application onto the device gains arbitrary code execution at kernel privilege, effectively full control of the operating system. That can lead to persistent compromise, data theft, or disabling of security controls.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the attacker must already have code running on the device or convince the user to open or install something. It is not remotely reachable over the network without that local foothold.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-05-23, indicating exploitation in the wild; EPSS gives a 30-day probability of 0.04551 (91st percentile). No ransomware campaign use is documented.

What to do

• Update iOS to 12.1.4 or later immediately; this is the vendor fix and the required KEV action.
• Enforce a minimum iOS version through MDM or device policy so unpatched devices are blocked or flagged.
• Restrict installation of applications to trusted sources and review enterprise-signed apps, since the attack requires local code execution.
• Monitor for and remove suspicious or sideloaded applications on managed devices.

Detection

• Inventory iOS versions across managed and BYOD devices and alert on any device below 12.1.4.
• Monitor for unexpected kernel panics or crashes that could indicate memory corruption exploitation attempts.
• Review application installation logs for sideloaded or enterprise-signed apps that bypass the App Store.
• Correlate CISA KEV status with asset inventory to confirm no exposed devices remain unpatched.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.