The Fully Remote Attack Surface of the iPhone
Summary: Project Zero's Natalie Silvanovich investigated the iPhone's fully remote, interaction-less attack surface across SMS, MMS, Visual Voicemail, Email and iMessage, and found several serious vulnerabilities. She identified CVE-2019-8613, a use-after-free of an NSString in the IMAP library triggered by a malicious VVM server mishandling the NAMESPACE command, and CVE-2019-8626, a memory corruption in MIME processing where an incoming MIME type string was appended to 'decode' and called as a selector.
Key Takeaway: The iMessage 'bp' field is deserialized in SpringBoard for notifications with no sandboxing on iOS, making it a fully remote attack surface reachable without any user interaction. VVM also lets a device connect to a malicious IMAP server with no user action, an attack surface the IMAP library was never tested against because email clients normally only connect to servers users type in by hand.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026