{"id":"CVE-2019-8506","kind":"vulnerability","aliases":["CVE-2019-8506"],"related":[],"title":"Apple Multiple Products: Apple Multiple Products Type Confusion Vulnerability","description":"A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.","summary":"A type confusion bug in multiple Apple products lets crafted web content be processed in a way that corrupts memory. An attacker who gets a user to load a malicious web page can run code on the device.","severity":"critical","cvss":9.3,"epss":0.16159,"exploited":true,"exploited_at":"2022-05-04T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","ios","macos","safari","vendor","webkit"],"not_affected_if":["unpatched-old-versions-only"],"how_to_check":"Check the installed Apple OS and Safari versions against Apple's security notes for this CVE; the sources do not give a specific version or command.","fix":"Update Apple devices and Safari to the latest version per Apple's vendor instructions named in the CISA KEV entry.","status":"open","published_at":"2019-12-18T18:15:22+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:17:38+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:17:38Z","model":"claude-haiku-5-5","output":{"fix":"Update Apple devices and Safari to the latest version per Apple's vendor instructions named in the CISA KEV entry.\nunknown","reach":"internet","impact":"high","summary":"A type confusion bug in multiple Apple products lets crafted web content be processed in a way that corrupts memory. An attacker who gets a user to load a malicious web page can run code on the device.","category":"vendor","who_cares":["apple","ios","macos","safari","webkit"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code after the user visits a malicious web page.","analyst_note":"Find the affected Apple product versions and fixed builds in Apple's security advisory for CVE-2019-8506, since the sources list no versions.","how_to_check":"Check the installed Apple OS and Safari versions against Apple's security notes for this CVE; the sources do not give a specific version or command.","needs_analyst":true,"not_affected_if":["unpatched-old-versions-only"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000473,"input_tokens":2823,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':11A,14A '-8506':12A,15A '12.1':86C '12.2':80C,82C '12.9.4':88C '5.2':84C '7.11':94C 'address':69C 'appl':1A,4A,19B,32B 'apple':16A 'arbitrari':103C 'attack':47B 'bug':29B 'code':60B,104C 'confus':8A,28B,66C 'content':37B,99C 'corrupt':44B 'craft':35B,97C 'cve':10A,13A 'devic':63B 'execut':105C 'exploit':20B 'fix':77C 'get':49B 'handl':73C 'icloud':91C 'improv':71C 'io':21B,79C 'issu':67C,75C 'itun':87C 'lead':101C 'let':34B 'load':53B 'maco':22B 'malici':55B,96C 'may':100C 'memori':45B,72C 'multipl':2A,5A,31B 'multiple':17A 'page':57B 'process':39B,95C 'product':3A,6A,33B 'products':18A 'run':59B 'safari':23B,85C 'tvos':81C 'type':7A,27B,65C 'user':51B 'vendor':24B 'vulner':9A 'watcho':83C 'way':42B 'web':36B,56B,98C 'webkit':25B 'window':90C,93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-18T18:15:22+00:00","kev":{"dateAdded":"2022-05-04","dueDate":"2022-05-25","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-8506","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8506","severity":null,"published_at":"2022-05-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2019-8506","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-8506","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-8506","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8506","severity":null,"published_at":"2019-12-18T18:15:22+00:00","modified_at":"2026-06-17T02:42:03+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}