CVE-2019-8661 | ByteOS Network

Vulnerability Details :

CVE-2019-8661

Assigner-apple

Assigner Org ID-286789f9-fbc2-4510-9f9a-43facdede74c

Published At-18 Dec, 2019 | 17:33

Updated At-04 Aug, 2024 | 21:24

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.6. A remote attacker may be able to cause arbitrary code execution.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:apple

Assigner Org ID:286789f9-fbc2-4510-9f9a-43facdede74c

Published At:18 Dec, 2019 | 17:33

Updated At:04 Aug, 2024 | 21:24

▼CVE Numbering Authority (CNA)

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.6. A remote attacker may be able to cause arbitrary code execution.

Affected Products

Vendor

Product

Versions

Affected

From unspecified before macOS Mojave 10.14.6 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	A remote attacker may be able to cause arbitrary code execution

Type: text

CWE ID: N/A

Description: A remote attacker may be able to cause arbitrary code execution

References

Hyperlink	Resource
https://support.apple.com/HT210348	x_refsource_MISC

Hyperlink: https://support.apple.com/HT210348

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://support.apple.com/HT210348	x_refsource_MISC x_transferred

Hyperlink: https://support.apple.com/HT210348

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:product-security@apple.com

Published At:18 Dec, 2019 | 18:15

Updated At:19 Dec, 2019 | 21:53

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.6. A remote attacker may be able to cause arbitrary code execution.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

>>mac_os_x>>Versions before 10.14.6(exclusive)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-416	Primary	nvd@nist.gov

CWE ID: CWE-416

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://support.apple.com/HT210348	product-security@apple.com	Vendor Advisory

Hyperlink: https://support.apple.com/HT210348

Source: product-security@apple.com

Resource:

Vendor Advisory

Similar CVEs

1961Records found

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-7.12% / 91.17%

||

7 Day CHG~0.00%

Published-09 Feb, 2012 | 02:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to error handling for Cascading Style Sheets (CSS) token-sequence data.

Vendor-n/a Google LLC Apple Inc.

Product-iphone_os itunes safari chrome n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-2.29% / 84.06%

||

7 Day CHG~0.00%

Published-13 Dec, 2011 | 21:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to Range handling.

Vendor-n/a Google LLC Apple Inc.

Product-iphone_os itunes safari chrome n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-2.34% / 84.23%

||

7 Day CHG~0.00%

Published-24 Jan, 2012 | 02:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM selections.

Vendor-n/a Google LLC Apple Inc.

Product-iphone_os itunes safari chrome n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-2.29% / 84.06%

||

7 Day CHG~0.00%

Published-29 Aug, 2011 | 15:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Google Chrome before 13.0.782.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a line box.

Vendor-n/a Google LLC Apple Inc.

Product-iphone_os itunes safari chrome n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-0.70% / 71.13%

||

7 Day CHG~0.00%

Published-23 Feb, 2013 | 21:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a URL.

Vendor-n/a openSUSE Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-linux_kernel opensuse chrome windows mac_os_x n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-2.12% / 83.43%

||

7 Day CHG~0.00%

Published-17 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to table styles.

Vendor-n/a Google LLC Apple Inc.

Product-iphone_os itunes safari chrome n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.69% / 90.04%

||

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:46

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-4.82% / 89.08%

||

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:56

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-4.82% / 89.08%

||

7 Day CHG~0.00%

Published-19 Dec, 2019 | 15:01

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-4.82% / 89.08%

||

7 Day CHG~0.00%

Published-19 Dec, 2019 | 14:37

Updated-05 Aug, 2024 | 01:17

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc macos windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.45% / 79.98%

||

7 Day CHG~0.00%

Published-25 Mar, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the HTMLCollection implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Vendor-n/a Apple Inc.Debian GNU/Linux Google LLC

Product-debian_linux iphone_os itunes safari chrome n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-27.68% / 96.26%

||

7 Day CHG~0.00%

Published-05 Nov, 2010 | 16:28

Updated-11 Apr, 2025 | 00:51

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.

Vendor-n/a SUSE Debian GNU/Linux Canonical Ltd.Fedora Project Red Hat, Inc.openSUSE Apple Inc.

Product-ubuntu_linux enterprise_linux fedora debian_linux opensuse linux_enterprise linux_enterprise_server enterprise_linux_workstation enterprise_linux_server enterprise_linux_desktop cups mac_os_x mac_os_x_server n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-2.11% / 83.40%

||

7 Day CHG~0.00%

Published-29 Jul, 2024 | 22:17

Updated-13 Feb, 2025 | 17:53

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari visionos macos visionOS iOS and iPadOS tvOS macOS Safari watchOS ios safari watch_os visionos ipad_os mac_os tv_os

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.62% / 69.07%

||

7 Day CHG~0.00%

Published-18 Mar, 2022 | 17:59

Updated-03 Aug, 2024 | 03:21

A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. An application may be able to gain elevated privileges.

Vendor-Apple Inc.

Product-iphone_os macos ipados tvos tvOS macOS iOS and iPadOS

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-3.92% / 87.83%

||

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, and CVE-2016-4110.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel iphone_os flash_player_desktop_runtime air_desktop_runtime air_sdk air_sdk_\&_compiler windows windows_8.1 mac_os_x android windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-93.28% / 99.80%

||

7 Day CHG-0.06%

Published-06 Feb, 2018 | 20:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-05-03||The impacted product is end-of-life and should be disconnected if still in use.

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

Vendor-n/a Adobe Inc.Microsoft Corporation Apple Inc.Red Hat, Inc.Google LLC Linux Kernel Organization, Inc

Product-windows_8.1 macos chrome_os linux_kernel enterprise_linux_desktop windows_10 flash_player enterprise_linux_server windows enterprise_linux_workstation Adobe Flash Player before 28.0.0.161 Flash Player

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-2.17% / 83.63%

||

7 Day CHG~0.00%

Published-16 Oct, 2020 | 16:40

Updated-04 Aug, 2024 | 10:43

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos ipados tvos safari icloud iTunes for Windows watchOS iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-8.34% / 91.92%

||

7 Day CHG~0.00%

Published-12 Jun, 2020 | 13:17

Updated-04 Aug, 2024 | 10:34

Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel windows_8.1 chrome_os windows flash_player_desktop_runtime macos windows_10 flash_player Adobe Flash Player

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-11.48% / 93.33%

||

7 Day CHG~0.00%

Published-15 Feb, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.

Vendor-n/a openSUSE Apple Inc.Debian GNU/Linux F5, Inc.Canonical Ltd.

Product-nginx leap ubuntu_linux debian_linux xcode n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-4.38% / 88.54%

||

7 Day CHG~0.00%

Published-13 Feb, 2020 | 15:47

Updated-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-4.38% / 88.54%

||

7 Day CHG~0.00%

Published-13 Feb, 2020 | 15:44

Updated-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-31.84% / 96.66%

||

7 Day CHG~0.00%

Published-25 Mar, 2020 | 17:27

Updated-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-20.74% / 95.38%

||

7 Day CHG~0.00%

Published-25 Mar, 2020 | 17:15

Updated-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-25.38% / 95.99%

||

7 Day CHG~0.00%

Published-25 Mar, 2020 | 15:58

Updated-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.62% / 69.22%

||

7 Day CHG-1.20%

Published-21 May, 2021 | 16:15

Updated-04 Aug, 2024 | 17:23

A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Vendor-webmproject n/a Red Hat, Inc.Apple Inc.Debian GNU/Linux NetApp, Inc.

Product-iphone_os libwebp debian_linux ipados ontap_select_deploy_administration_utility enterprise_linux libwebp

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.44% / 62.38%

||

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-06 Dec, 2024 | 18:56

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.6.6, macOS Monterey 12.3, Security Update 2022-004 Catalina. A remote user may cause an unexpected app termination or arbitrary code execution

Vendor-Apple Inc.

Product-macos mac_os_x macOS

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.06% / 19.08%

||

7 Day CHG~0.00%

Published-29 Jul, 2025 | 23:29

Updated-31 Jul, 2025 | 19:56

A use-after-free issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, iPadOS 17.7.9, macOS Ventura 13.7.7, macOS Sonoma 14.7.7. An attacker may be able to cause unexpected app termination.

Vendor-Apple Inc.

Product-ipados macos iPadOS macOS

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-71.12% / 98.65%

||

7 Day CHG~0.00%

Published-15 Jan, 2014 | 02:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-03-24||Apply updates per vendor instructions.

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Microsoft Corporation Adobe Inc.Apple Inc.

Product-windows acrobat mac_os_x n/a Reader and Acrobat

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.17% / 89.51%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:58

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.50%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:51

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-35.34% / 96.92%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:47

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.27% / 89.61%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:25

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.17% / 89.51%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:49

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc macos windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.50%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:33

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.27% / 89.61%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:25

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.50%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:08

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-2.03% / 83.06%

||

7 Day CHG~0.00%

Published-12 Sep, 2019 | 18:07

Updated-04 Aug, 2024 | 21:10

Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.

Vendor-Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel windows_8.1 chrome_os windows flash_player_desktop_runtime macos windows_10 flash_player Flash Player

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-6.22% / 90.51%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.4, tvOS 12.4, watchOS 5.3. A remote attacker may be able to cause arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os watchos tvos tvOS watchOS iOS

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.17% / 89.51%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:47

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.27% / 89.61%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:25

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-5.27% / 89.61%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:25

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-0.66% / 70.26%

||

7 Day CHG~0.00%

Published-23 Feb, 2013 | 21:00

Updated-11 Apr, 2025 | 00:51

Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect memory access) or possibly have unspecified other impact via a large number of SVG parameters.

Vendor-n/a openSUSE Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-linux_kernel opensuse chrome windows mac_os_x n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-14.43% / 94.17%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

This issue was addressed with improved checks. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary.

Vendor-Apple Inc.

Product-mac_os_x iphone_os watchos tvos tvOS macOS watchOS iOS

CWE ID-CWE-416

Use After Free

CWE ID-CWE-502

Deserialization of Untrusted Data

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.50%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:53

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Chrome

Matching Score-10

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-0.61% / 68.90%

||

7 Day CHG~0.00%

Published-23 Feb, 2013 | 21:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to databases.

Vendor-n/a openSUSE Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-linux_kernel opensuse chrome windows mac_os_x n/a

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.25% / 48.44%

||

7 Day CHG+0.06%

Published-10 Jan, 2024 | 22:03

Updated-20 Jun, 2025 | 16:15

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 10, iOS 17 and iPadOS 17, tvOS 17, macOS Sonoma 14, Safari 17. Processing web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os macos safari tvos ipados watchos tvOS macOS watchOS Safari iOS and iPadOS

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.46% / 63.30%

||

7 Day CHG~0.00%

Published-28 Jul, 2023 | 04:30

Updated-13 Feb, 2025 | 17:02

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados macos iOS and iPadOS macOS tvOS watchOS

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-93.28% / 99.80%

||

7 Day CHG-0.06%

Published-18 Jan, 2019 | 17:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-08-15||The impacted product is end-of-life and should be disconnected if still in use.

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Microsoft Corporation Apple Inc.Red Hat, Inc.Google LLC Linux Kernel Organization, Inc

Product-chrome_os mac_os_x enterprise_linux_server flash_player_installer linux_kernel enterprise_linux_desktop windows_10 flash_player windows_8.1 windows enterprise_linux_workstation n/a Flash Player

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-6.77% / 90.92%

||

7 Day CHG~0.00%

Published-23 May, 2019 | 16:55

Updated-04 Aug, 2024 | 20:38

Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel windows_8.1 chrome_os mac_os_x windows flash_player_desktop_runtime windows_10 flash_player Adobe Flash Player

CWE ID-CWE-416

Use After Free

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-1.86% / 82.29%

||

7 Day CHG~0.00%

Published-23 May, 2019 | 16:59

Updated-04 Aug, 2024 | 20:38

Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free