iOS
CVE-2025-43186
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a significant technical severity versus moderate real-world risk paradox. The CVSS 9.8 critical score reflects maximum impact potential: network-accessible remote code execution requiring no authentication or user interaction, with complete confidentiality, integrity, and availability compromise possible. However, multiple real-world risk indicators suggest substantially lower immediate threat. The EPSS score of 0.16% places this in the 37th percentile, indicating exploitation probability lower than 63% of all tracked vulnerabilities. Absence from CISA KEV confirms no detected active exploitation against federal networks. The lack of publicly available exploit code further reduces immediate weaponization risk. SSVC framework analysis suggests deferred prioritization: while technical impact is total system compromise and the vulnerability appears automatable given UI:N requirements, the exploitation status remains none detected. This disconnect likely reflects Apple's rapid coordinated patch release across all platforms before threat actors developed working exploits, combined with the technical difficulty of weaponizing buffer overflows in modern Apple platforms with comprehensive memory protections like pointer authentication codes, hardened runtime, and ASLR. Organizations should prioritize patching internet-facing Apple devices and those processing untrusted files, but the absence of exploitation signals allows for measured rollout rather than emergency response. |
| Exploit ScenarioDerived | An attacker crafts a malformed file exploiting buffer overflow conditions in Apple's file parsing libraries and hosts it on a compromised website or delivers it via phishing email. When a victim's device attempts to parse the file-either through automatic processing by mail clients generating previews, Safari downloading and quick-looking files, or AirDrop reception triggers-the buffer overflow overwrites critical memory structures. The attacker achieves arbitrary code execution with the privileges of the parsing process, potentially leading to full device compromise including data exfiltration, surveillance capability installation, or lateral movement in enterprise environments. The network attack vector and zero user interaction requirement mean exploitation could occur silently during routine device operations without victim awareness. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS 18.6, macOS (Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7), tvOS 18.6, visionOS 2.6, and watchOS 11.6. Unauthenticated attackers can trigger arbitrary code execution by delivering a maliciously crafted file requiring no user interaction beyond parsing. Despite CVSS 9.8 critical severity, EPSS score of 0.16% (37th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis and not listed in CISA KEV, suggesting theoretical risk exceeds current real-world threat activity.
RemediationAI
Vendor-released patches are available for all affected platforms. Users should immediately update to iOS 18.6 and iPadOS 18.6 via Settings > General > Software Update. macOS users should update to Sequoia 15.6, Sonoma 14.7.7, or Ventura 13.7.7 depending on their installed major version through System Settings > General > Software Update. Additional patches include tvOS 18.6, visionOS 2.6, and watchOS 11.6. Apple's coordinated July 2025 security update addresses the vulnerability through improved memory handling per advisory HT215086 and related bulletins. Organizations should prioritize devices with internet exposure or processing untrusted files, while enterprise deployments can leverage mobile device management systems for centralized update deployment. No effective workarounds exist short of disabling file processing capabilities, making patching the only viable mitigation. Full advisory details available at https://support.apple.com/en-us/124147 and subsequent numbered advisories through 124155.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from CWE-119 (improper restriction on operations within memory buffer bounds), specifically a buffer overflow condition in file parsing routines shared across Apple's operating system ecosystem. The affected components span eight distinct Apple OS platforms, indicating a common parsing library or framework vulnerability in the core system services. Buffer overflows of this class typically occur when input validation fails to properly constrain data written to fixed-size memory buffers during file format interpretation, allowing attackers to overwrite adjacent memory regions. The CVSS vector indicates network-accessible attack surface (AV:N) with low complexity (AC:L), meaning the vulnerability can be triggered remotely without complex timing or environmental prerequisites. The complete absence of privilege requirements (PR:N) and user interaction requirements (UI:N) suggests the vulnerable parsing occurs automatically when processing network-delivered content, potentially through services like mail attachment processing, file sharing protocols, or browser download handlers.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Parsing a file may lead to an unexpected app termination.
Executive ViewAI
CVE-2025-43186 is a critical buffer overflow in Apple's file parsing components affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS that enables remote code execution without user interaction or authentication. While the CVSS score of 9.8 reflects severe technical impact, the 0.2% EPSS score and absence of active exploitation suggest the vulnerability remains theoretical rather than an immediate operational threat, though it warrants priority remediation planning given Apple's ecosystem scale.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict file uploads and file-sharing mechanisms to trusted sources only, implement network segmentation to limit lateral movement from potentially compromised devices, enforce strict email attachment policies blocking potentially malicious file types, and increase endpoint monitoring for anomalous code execution patterns on affected Apple platforms.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a deni
Out-of-bounds write vulnerability in WebKit across Apple's entire operating system ecosystem allows remote code executio
GitHub PoC
Exploit-DB