CVE-2019-7286

What Is Affected?

This vulnerability affects the Foundation framework shared across iOS, macOS, watchOS, and tvOS — core Apple operating system code used by nearly every application and system process, making a memory-safety bug here broadly reachable from many different attack surfaces, including Messages.

Overview

CVE-2019-7286 is a memory corruption vulnerability (CWE-787, out-of-bounds write) that can be triggered by processing maliciously crafted content, leading to privilege escalation. It gained particular notoriety after Citizen Lab's December 2020 report "The Great iPwn" revealed that NSO Group's Pegasus spyware used this flaw as part of a zero-click iMessage exploit chain — dubbed "Kismet" — deployed against Al Jazeera journalists and other targets in 2020, well after Apple had already patched the underlying bug in December 2019.

Technical Details

The flaw is an out-of-bounds write in Apple's Foundation framework, allowing an application processing attacker-controlled input to corrupt memory outside its intended bounds. On its own this can crash affected processes; combined with an initial-access exploit (such as a malicious iMessage attachment) and further memory corruption, it can be used for local privilege escalation to gain deeper control of the device.

Discovery

Citizen Lab (University of Toronto) publicly documented real-world use of this vulnerability in its December 2020 report "The Great iPwn: Journalists Hacked with Suspected NSO Group iMessage 'Zero-Click' Exploit," attributing the Kismet exploit chain to NSO Group's Pegasus spyware. Apple itself fixed the underlying bug in iOS 13.3 in December 2019 through routine security updates, ahead of Citizen Lab's public attribution of in-the-wild use.

Exploitation Context

This is one of the more well-documented cases of a patched Apple memory-corruption bug being retroactively confirmed as part of an active spyware exploit chain: NSO Group's Kismet chain used CVE-2019-7286 for privilege escalation after gaining initial code execution via a zero-click iMessage exploit, targeting journalists at Al Jazeera and Al Araby. CISA's KEV listing reflects this confirmed, nation-state-adjacent exploitation.

Remediation

1. Update all Apple devices (iPhone, iPad, Mac, Apple Watch, Apple TV) to the latest supported OS version — iOS 13.3/macOS Catalina 10.15.2 resolved this specific issue, and current versions include many subsequent fixes.
2. High-risk individuals (journalists, activists, dissidents) should enable Apple's Lockdown Mode on supported devices.
3. Treat unexpected message content with caution even though this class of attack requires no user interaction.
4. Use Apple's official update mechanism and avoid delaying OS updates on managed device fleets.
5. Organizations supporting at-risk users should monitor for indicators of compromise using tools like Amnesty International's Mobile Verification Toolkit (MVT).