Apple iOS and macOS Group FaceTime Remote Eavesdropping Vulnerability (CVE-2019-6223)

1. Vulnerability Overview & Root Cause

A critical logic issue existed in the state management and session handling of Group FaceTime calls. The FaceTime protocol failed to properly validate the call state machine, allowing media stream negotiation (audio/video) to complete and transmit data before the recipient explicitly accepted the incoming call invitation.

2. Exploitation Mechanics & Attack Scenario

The vulnerability can be exploited through the following steps:

• The attacker initiates a standard FaceTime video call to the target recipient.
• While the target's device is ringing, the attacker swipes up and selects 'Add Person' to convert the call into a Group FaceTime session.
• The attacker adds their own phone number to the active session.
• Due to the flawed state management, the FaceTime subsystem assumes a group call has been established and immediately activates the recipient's microphone, transmitting live audio back to the attacker without any user interaction or consent from the recipient.

3. Infrastructure & Business Impact

This vulnerability poses an extreme privacy risk, effectively turning corporate and personal Apple devices into remote listening bugs. Given its inclusion in the CISA KEV catalog, this flaw represents a highly reliable vector for targeted espionage and unauthorized data collection within sensitive corporate environments.