Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641
Summary: Project Zero's Samuel Groß detailed CVE-2019-8641, an iMessage vulnerability on iOS 12.4 that let an attacker holding only a target's Apple ID gain remote control of the device within minutes, with no user interaction and no on-screen indicator. Reported to Apple on July 29, 2019, the bug was mitigated in iOS 12.4.1 on August 26 by making the vulnerable code unreachable over iMessage, then fully fixed in iOS 13.2 on October 28, 2019.
What you should know: The exploit required nothing from the victim beyond an Apple ID - no link to tap, no notification - and could pull files, passwords, 2FA codes, SMS, and email, or activate the microphone and camera; Groß notes skilled attackers likely already had this capability from patch analysis or by pairing the CVE-2019-8646 infoleak with other memory corruption bugs.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-8641CVE-2019-8646
- Related
- The Many Possibilities of CVE-2019-8646 Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026