{"id":"CVE-2019-8526","kind":"vulnerability","aliases":["CVE-2019-8526"],"related":[],"title":"apple mac os x: A use after free issue was addressed with improved memory management","description":"A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.","summary":"Apple macOS has a use-after-free memory bug that lets a local user escalate privileges. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-04-17T00:00:00+00:00","products":[{"name":"Apple macOS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple mac os x","fixed":["10.14.4"],"affected":"< 10.14.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","infrastructure","macos"],"not_affected_if":["fully-patched-macos"],"how_to_check":null,"fix":"Apply the macOS updates per Apple's vendor instructions, as CISA requires; the fixed version is unknown from these sources.","status":"open","published_at":"2019-12-18T18:15:24+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:55+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:06:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the macOS updates per Apple's vendor instructions, as CISA requires; the fixed version is unknown from these sources.","reach":"local","impact":"high","summary":"Apple macOS has a use-after-free memory bug that lets a local user escalate privileges. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["macos","apple"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with local access gains elevated privileges on the Mac.","analyst_note":"Find the affected and fixed macOS versions and the Apple security advisory for CVE-2019-8526 (support.apple.com security notes) to fill in how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched-macos"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00044,"input_tokens":2762,"output_tokens":327,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':17A,20A '-8526':18A,21A '10.14.4':76C 'abl':81C 'activ':53B 'address':11A,64C 'appl':1A,28B,32B 'apple':22A,24A 'applic':78C 'bug':41B 'cisa':49B 'cve':16A,19A 'elev':84C 'escal':47B 'exploit':29B,54B 'fix':72C 'free':8A,39B,61C 'gain':83C 'improv':13A,66C 'infrastructur':30B 'issu':9A,62C,70C 'let':43B 'list':50B 'local':45B 'mac':2A,25A 'maco':31B,33B,74C 'macos':23A 'manag':15A,68C 'may':79C 'memori':14A,40B,67C 'mojav':75C 'os':3A,26A 'privileg':48B,85C 'use':6A,37B,59C 'use-after-fre':36B 'user':46B 'wild':57B 'x':4A,27A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-18T18:15:24+00:00","kev":{"dateAdded":"2023-04-17","dueDate":"2023-05-08","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-8526","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8526","severity":null,"published_at":"2023-04-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-8526","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8526","severity":null,"published_at":"2019-12-18T18:15:24+00:00","modified_at":"2026-06-17T02:42:06+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}