Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

watchOS lets removed iMessage users change chat state

CVE-2019-8659 · published 6 years ago
Summary

On Apple Watch devices running watchOS, a person who has been taken out of an iMessage group could still affect the conversation, such as updating read status. This could reveal information or cause confusion for the remaining participants. Updating the watch to watchOS 5.3 or newer applies the fix.

What to do
  • Update apple watchos to version 5.3 or later.
Affected software
VendorProductAffected versions
apple watchos < 5.3
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Original advisory text
This issue was addressed with improved checks. This issue is fixed in watchOS 5.3. Users removed from an iMessage conversation may still be able to alter state.
This issue was addressed with improved checks. This issue is fixed in watchOS 5.3. Users removed from an iMessage conversation may still be able to alter state.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published18 Dec 2019
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-8659 · NVD
Track software like this
Free during beta