---
id: "CVE-2019-8506"
kind: "vulnerability"
aliases: ["CVE-2019-8506"]
title: "Apple Multiple Products: Apple Multiple Products Type Confusion Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.16159
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple", "exploited", "ios", "macos", "safari", "vendor", "webkit"]
not_affected_if: ["unpatched-old-versions-only"]
published_at: "2019-12-18T18:15:22+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8506", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-8506", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8506", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apple Multiple Products: Apple Multiple Products Type Confusion Vulnerability

A type confusion bug in multiple Apple products lets crafted web content be processed in a way that corrupts memory. An attacker who gets a user to load a malicious web page can run code on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple Multiple Products affected ? fixed ?

## How to check

Check the installed Apple OS and Safari versions against Apple's security notes for this CVE; the sources do not give a specific version or command.

## Fix

Update Apple devices and Safari to the latest version per Apple's vendor instructions named in the CISA KEV entry.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8506
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-8506
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-8506

## From the sources

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_