Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-8626: iPhone OS and watchOS can crash from crafted message

CVE-2019-8626 · published 6 years ago

Summary

A specially formatted message could cause iPhone OS and watchOS devices to stop working temporarily. The problem is fixed in iOS version 12.3 and watchOS version 5.2.1. Install these updates as soon as possible to prevent possible service interruptions.

What to do

Update apple iphone_os to version 12.3 or later.
Update apple watchos to version 5.2.1 or later.

Affected software

Vendor	Product	Affected versions
apple	iphone_os	< 12.3 `cpe:2.3:o:apple:iphone_os::::::::`
apple	watchos	< 5.2.1 `cpe:2.3:o:apple:watchos::::::::`

Original advisory text

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1. Processing a maliciously crafted message may lead to a denial of service.

References

https://support.apple.com/HT210118 Vendor Advisory
https://support.apple.com/HT210122 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published18 Dec 2019

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2019-8626 · NVD

Track software like this

Free during beta