Skip to content
Fencer Vulns
high 7.5

CVE-2019-6223 kev in the critical feed json

A logic issue existed in the handling of Group FaceTime calls.

published 2019-03-05 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15790

cvss
7.5
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • Apple iOS iOS 12.1.3
  • Apple macOS macOS Mojave 10.14.3

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA patch deadline
  4. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2022-05-03 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Apple, iOS and macOS
CISA name
Apple iOS and macOS Group Facetime Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
14 mo ago

Exploit prediction

2.63% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Apple iOS
  • Apple macOS

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.