CVE-2018-4416: Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari…

PriorityP268high8.8CVSS 3.0

AVNACLPRNUIRSUCHIHAH

EXPLOIT

EPSS

34.17%

98.2th percentile

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 7.8	7.8
apple	icloud_for_windows	—	—
apple	ios	—	—
apple	iphone_os	< 12.1	12.1
apple	itunes	< 12.9.1	12.9.1
apple	itunes_12.9.1_for_windows	—	—
apple	safari	< 12.0.1	12.0.1
apple	safari	—	—
apple	tvos	< 12.1	12.1
apple	tvos	—	—
apple	watchos	< 5.1	5.1
apple	watchos	—	—
debian	webkit2gtk	< webkit2gtk 2.22.1-1 (bookworm)	webkit2gtk 2.22.1-1 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

→The vulnerability is a type confusion in WebKit JSC JIT triggered via JSPropertyNameEnumerator during a for-in loop. Detection should focus on JIT-compiled JavaScript using for-in loops that manipulate __proto__ assignments mid-loop to cause structure ID reuse/confusion. ↗
→The exploit pattern involves repeated __proto__ reassignment inside a for-in loop combined with forced garbage collection to free and reuse structure IDs, enabling type confusion. Monitor for JavaScript that reassigns __proto__ inside for-in loops alongside large ArrayBuffer allocations used as a GC trigger. ↗
→The PoC uses a fake object backed by a Uint32Array with a sentinel value (0x1234 at index 0) to demonstrate arbitrary memory read via the type-confused return value. Heuristic: watch for JavaScript that constructs typed arrays with small sentinel integers and passes them into JIT-optimized functions alongside prototype chain manipulation. ↗
→The exploit warms up JIT optimization with 500 iterations before triggering the vulnerability. Behavioral detection: JavaScript functions that loop 500+ times to trigger JIT then immediately perform prototype chain manipulation should be flagged as suspicious. ↗
→GC pressure is induced via repeated large ArrayBuffer allocations (10 x 10MB). Heuristic: detect JavaScript allocating multiple large ArrayBuffers (e.g., 10MB each) in rapid succession inside a loop, which is a common exploit GC-trigger pattern. ↗

·The vulnerability affects WebKit across multiple Apple platforms; patched versions are iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, and iCloud for Windows 7.8. Exploitation requires processing maliciously crafted web content. ↗
·Structure IDs in JSC can be reused after their owning structures are freed via GC, making this a use-after-free-style type confusion. There is no guard preventing the cached structure ID in JSPropertyNameEnumerator from becoming stale. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

osv8.8HIGH

vendor_debian8.8LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.