CVE-2019-8523: High severity Apple tvOS vulnerability

Q: What is CVE-2019-8523?

CVE-2019-8523 is a vulnerability in WebKit that could allow arbitrary code execution.

Q: How does CVE-2019-8523 impact iOS?

iOS versions up to and excluding 12.2 are affected by CVE-2019-8523, allowing potential arbitrary code execution.

Q: Is Safari affected by CVE-2019-8523?

Yes, Safari versions up to and excluding 12.1 are affected by CVE-2019-8523, which could lead to arbitrary code execution.

Q: What is the severity of CVE-2019-8523?

CVE-2019-8523 has a severity rating of 8.8 (critical).

Q: How can I fix CVE-2019-8523?

To fix CVE-2019-8523, update your software to iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, or iCloud for Windows 7.11.

Published Mar 25, 2019

Updated

Last updated 25 August 2025

Other sources

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

— Launchpad

WebKit. Multiple memory corruption issues were addressed with improved memory handling.

Credit

dwfault(ADLab of Venustech), Samuel Groß(Google Project Zero), Apple, G. Geshev(Trend Micro Zero Day Initiative), found by OSS-Fuzz

Affected Software

11 affected componentsFixes available

Apple tvOS<12.2

12.2

Apple iCloud for Windows<7.11

7.11

Apple iTunes for Windows<12.9.4

12.9.4

Apple Safari<12.1

12.1

Apple iOS<12.2

12.2

Apple Icloud Windows<7.11

Apple Itunes Windows<12.9.4

Apple Safari<12.1

Apple iPhone OS<12.2

Apple tvOS<12.2

debian/webkit2gtk

2.44.2-1~deb11u12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tvOS to a version that resolves this vulnerability.
Fixed in 12.2
Upgrade
Upgrade Apple iCloud to a version that resolves this vulnerability.
Fixed in 7.11
Upgrade
Upgrade iTunes to a version that resolves this vulnerability.
Fixed in 12.9.4
Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 12.1
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 12.2
Upgrade
Upgrade debian/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.44.2-1~deb11u1Fixed in 2.50.4-1~deb11u1Fixed in 2.50.4-1~deb12u1Fixed in 2.50.4-1~deb13u1Fixed in 2.50.5-1
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 12.2
Upgrade
Upgrade iTunes for Windows to a version that resolves this vulnerability.
Fixed in 12.9.4
Upgrade
Upgrade iCloud for Windows to a version that resolves this vulnerability.
Fixed in 7.11

Event History

Dec 18, 2019

CVE Published

via MITRE·05:33 PM

Data Sourced

via MITRE·05:33 PM

DescriptionWeakness

Data Sourced

via OSV·06:15 PM

DescriptionSeverity

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2019-8523?