CVE-2019-8520

Vulnerability

An out-of-bounds read vulnerability exists in macOS Mojave prior to version 10.14.4. The issue is present in an unspecified component and allows reading beyond allocated memory boundaries. Affected versions: macOS Mojave 10.14.3 and earlier. [1]

Exploitation

A malicious application installed on the system can trigger the out-of-bounds read. No special network position or authentication beyond local access is required; the attacker must have the ability to execute code on the device. The exact sequence of steps is not disclosed, but the vulnerability is reachable from user-space applications. [1]

Impact

Successful exploitation allows the malicious application to read restricted memory, potentially disclosing sensitive information such as cryptographic keys, passwords, or other confidential data. The impact is limited to information disclosure; no code execution or privilege escalation is indicated. [1]

Mitigation

Apple addressed the issue in macOS Mojave 10.14.4, released on March 25, 2019. Users should update to this version or later. No workarounds are provided. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. [1]