CVE-2019-8526

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be…

High7.8Known exploitedEPSS 0.70%

Published: 18 Dec 2019
Updated: 21 Oct 2025
Reserved: 18 Feb 2019
Assigned by: apple

Description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Apple macOS Use-After-Free Vulnerability.

Added: 17 Apr 2023
Fix due (US federal): 8 May 2023
Used by ransomware: Not known

Apply updates per vendor instructions.

Scores

CVSS scores of CVE-2019-8526, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.70% · top 47% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

An application may be able to gain elevated privileges
CWE-416 Use After Free (opens in a new tab)All about CWE-416 and its CVEs

Affected products

Apple · macOS
- affected unspecified – < macOS Mojave 10.14.4

References (2)

https://support.apple.com/HT209600 (opens in a new tab)x_refsource_MISCx_transferred
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8526 (opens in a new tab)government-resource

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2019-8526](https://trackcve.app/badge/CVE-2019-8526.svg)](https://trackcve.app/cve/CVE-2019-8526)

Record last updated 21 Oct 2025, 23:35 UTC.