CVE-2019-8605: Apple iOS, macOS, tvOS and watchOS use-after-free allows system code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8 high severity, CISA KEV active exploitation and a high EPSS percentile make this a priority despite the local vector and user interaction requirement.

What it is

A use-after-free flaw in Apple's memory management was fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3 and watchOS 5.2.1. A malicious application can trigger the bug to run arbitrary code with system privileges, so the flaw matters because it lets a local app escalate to full system control.

Impact

An attacker who gets a malicious app onto the device gains arbitrary code execution with system privileges, breaking out of the app sandbox and compromising the whole system.

Attack surface

The vector is local (AV:L) with no privileges required (PR:N) but user interaction is required (UI:R), meaning the victim must run or open the malicious application. It is not remotely reachable without that local app and user action.

Exploitation

CVE-2019-8605 is listed in CISA KEV (added 2022-06-27, due 2022-07-18), indicating known exploitation in the wild, and EPSS shows a 30-day probability of 0.17513 (96.977th percentile). References are vendor advisories and the CISA KEV entry; no public exploit code is cited in the record.

What to do

• Update to iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3 or watchOS 5.2.1 (or later) per Apple advisories HT210118, HT210119, HT210120 and HT210122.
• Prioritize patching devices that cannot be updated or are past end-of-support, since KEV confirms active exploitation.
• Restrict installation of applications to trusted sources and enforce mobile device management controls to reduce the chance of a malicious app being run.
• Monitor for and remove sideloaded or untrusted applications on managed Apple devices.

Detection

• Audit managed Apple devices for OS versions below iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3 and watchOS 5.2.1.
• Alert on unexpected process crashes or memory corruption reports in Apple system components on affected versions.
• Track execution of untrusted or sideloaded applications on macOS and iOS endpoints.
• Correlate endpoint telemetry for processes gaining system privileges from a user-launched app.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.