The Many Possibilities of CVE-2019-8646

Summary: Project Zero's Natalie Silvanovich reported CVE-2019-8646, an iMessage flaw introduced in iOS 12.1 in which the unsafe class _NSDataFileBackedFuture can be deserialized remotely, letting an attacker read files and leak memory. She chained it with the NSString subclass INDeferredLocalizedString, whose value can change after URL validation, to send leaked memory to a remote server as a URL parameter.
Bottom line: The leak is capped at the first null character, so it usually sends only a few bytes - enough to leak a single pointer and break ASLR with enough tries, but not to exfiltrate a file. A single deserializable class in a messaging parser was enough to turn a minor functional bug into a remote memory disclosure.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-8646
Related: Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641 Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026