CVE-2019-8567: Apple iPhone OS

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.2. A device may be passively tracked by its WiFi MAC address.

Affected products

• Apple iPhone OS: before 12.2 (fixed in 12.2)

Published 2019-12-18. Last modified 2026-06-17.