CVE-2019-6223

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A logic issue in the handling of Group FaceTime calls, caused by inadequate state management, affected Apple iOS and macOS devices prior to the listed updates. The vulnerability resided in the FaceTime component and carried a CVSS 3.1 base score of 7.5, reflecting network-accessible exploitation with no required privileges or user interaction and a high impact on confidentiality.

An unauthenticated remote attacker acting as the initiator of a Group FaceTime call could exploit the flaw to force the recipient’s device to answer automatically, thereby gaining unauthorized audio or video access without the recipient’s knowledge or consent.

Apple addressed the issue through improved state management in iOS 12.1.4 and the macOS Mojave 10.14.3 Supplemental Update, as documented in security advisories HT209520 and HT209521. The vulnerability is also catalogued by CISA as one known to have been exploited in the wild.