CVE-2019-8537

Vulnerability

An access issue in the Notes app on macOS Mojave prior to version 10.14.4 allows a local user to view another user's locked notes. The vulnerability stems from improper memory management that fails to enforce the lock mechanism on notes, enabling unauthorized access to protected content.

Exploitation

An attacker with local access to the system as a user can exploit this memory management flaw to bypass the lock on notes. The exact exploitation steps are not publicly disclosed, but the attack likely involves reading memory or exploiting a race condition to access the locked notes without the required password.

Impact

Successful exploitation allows a local attacker to view the contents of another user's locked notes, resulting in unauthorized disclosure of sensitive information. The attacker gains read access to notes that were intended to be private, compromising confidentiality.

Mitigation

The vulnerability is fixed in macOS Mojave 10.14.4, released on March 25, 2019 [1]. Users should update to this version or later. No workarounds are documented. The issue is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.