In-the-wild iOS Exploit Chain 5

Summary: Project Zero's Ian Beer documented an in-the-wild iOS exploit chain, dubbed In-the-wild iOS Exploit Chain 5, that targeted iPhone 5s through X running iOS 11.4.1 through 12.1.2, exploiting a use-after-free in the task_swap_mach_voucher kernel MIG method. The vulnerable code shipped in 2014 with an unfinished 'vouchers' feature and was patched by Apple on January 22, 2019 in iOS 12.1.4 as CVE-2019-6225, an issue independently reported by Brandon Azad on December 6, 2018 and used by @S0rryMybad to win $200,000 at the TianFu Cup PWN competition on November 17, 2018.
What's compelling: The attackers abandoned a working exploit chain for this one because it was more reliable and used a single vulnerability, and the bug sat reachable from every sandbox for four years because no test ever called the syscall with valid arguments.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-6225
Related: voucher_swap: Exploiting MIG reference counting in iOS 12 Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026