CVE-2019-7287

What Is Affected?

This vulnerability affects iOS, Apple's mobile operating system, in a component reachable by content processed on the device.

Overview

CVE-2019-7287 is a memory corruption vulnerability (CWE-787, out-of-bounds write) that can be triggered by processing maliciously crafted content, potentially allowing an attacker to execute arbitrary code. Apple fixed it in iOS 13.3, released in December 2019 — the same update round that patched the related CVE-2019-7286, which was later confirmed by Citizen Lab to have been used in NSO Group's "Kismet" zero-click iMessage spyware chain against journalists.

Technical Details

The flaw is an out-of-bounds write triggered when the operating system processes attacker-supplied content, allowing memory to be corrupted beyond its intended bounds. This class of bug is a common building block for remote exploit chains: an attacker who can deliver crafted content to the device (for example through a message, file, or malicious web content) may be able to leverage the corruption to execute arbitrary code or escalate privileges, typically as one stage of a multi-bug exploit chain rather than in isolation.

Discovery

Fixed by Apple in iOS 13.3 in December 2019 as part of routine security maintenance; NVD does not credit an individual external researcher for this entry specifically.

Exploitation Context

CISA added this CVE to the KEV catalog in May 2022, confirming real-world exploitation. It was disclosed and patched in the same December 2019 update as CVE-2019-7286, a closely related memory-corruption bug that was subsequently documented by Citizen Lab as part of a commercial spyware exploit chain — underscoring that iOS memory-safety bugs from this period were of significant interest to sophisticated threat actors targeting high-risk individuals.

Remediation

1. Update all iOS/iPadOS devices to the latest supported version.
2. High-risk individuals (journalists, activists, dissidents) should enable Apple's Lockdown Mode on supported devices.
3. Avoid opening unsolicited attachments, links, or files from untrusted sources.
4. Enable automatic updates so future security fixes are applied promptly.
5. Organizations supporting at-risk users should monitor for indicators of compromise using tools like Amnesty International's Mobile Verification Toolkit (MVT).