CVE-2019-8671: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari…

PriorityP265high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EXPLOIT

EPSS

7.71%

94.0th percentile

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Affected

22 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 7.13	7.13
apple	icloud	>= 10.0 < 10.6	10.6
apple	icloud_for_windows	—	—
apple	icloud_for_windows	—	—
apple	icloud_for_windows	>= unspecified < iCloud for Windows 7.13	iCloud for Windows 7.13
apple	icloud_for_windows	>= unspecified < iCloud for Windows 10.6	iCloud for Windows 10.6
apple	ios	—	—
apple	ios	>= unspecified < iOS 12.4	iOS 12.4
apple	iphone_os	< 12.4	12.4
apple	itunes	< 12.9.6	12.9.6
apple	itunes_12.9.6_for_windows	—	—
apple	itunes_for_windows	>= unspecified < iTunes for Windows 12.9.6	iTunes for Windows 12.9.6
apple	mac_os_x	< 10.14.6	10.14.6
apple	macos	>= unspecified < macOS Mojave 10.14.6	macOS Mojave 10.14.6
apple	macos_mojave_10.14.6_security_update_2019-004_high_sierra_security_update_2019-0	—	—
apple	safari	< 12.1.2	12.1.2
apple	safari	—	—
apple	safari	>= unspecified < Safari 12.1.2	Safari 12.1.2
apple	tvos	< 12.4	12.4
apple	tvos	—	—
apple	tvos	>= unspecified < tvOS 12.4	tvOS 12.4
debian	webkit2gtk	< webkit2gtk 2.24.2-1 (bookworm)	webkit2gtk 2.24.2-1 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

→Trigger point is JavaScriptCore's JIT compiler (DFG/FTL): look for crashes or anomalous behavior in jsc process when processing JavaScript that forces JIT compilation via hot loops combined with Arguments object property access (.length) ↗
→The vulnerability is triggered by LICM (Loop-Invariant Code Motion) hoisting GetButterfly and GetByOffset operations ahead of their guarding CheckStructure — monitor for JIT-compiled JS that accesses .length on Arguments objects inside nested loops with object property mutations in the inner loop body ↗
→Exploit pattern involves a JavaScript function with: (1) a hot outer loop to force JIT, (2) an inner loop iterating over an Arguments object, and (3) a NewObject + PutStructure inside the inner loop body to trigger the unsafe LICM hoist ↗
→The unsafe hoist bypasses StructureChecks in the JIT broadly — detection should consider any JS that causes CheckStructure to be separated from its dependent GetButterfly/GetByOffset in DFG IR, not just Arguments objects ↗
→Cross-reference with Project Zero issue trackers for related LICM exploitation patterns in JavaScriptCore ↗

·Vulnerability exists in WebKit/JavaScriptCore across multiple Apple platforms; patched versions are iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6 — unpatched webkitgtk on RHEL 6/7 will not be fixed ↗
·Red Hat webkitgtk (RHEL 6) is out of support scope and webkitgtk3 (RHEL 7) will not be fixed, leaving those packages permanently vulnerable ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

osv8.8HIGH

vendor_debian8.8HIGH

vendor_redhat8.8HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.