What is the CVSS score of CVE-2025-43186?

CVE-2025-43186 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of iOS are affected by CVE-2025-43186?

CVE-2025-43186 is a critical buffer overflow in Apple's file parsing components affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS that enables remote code execution without user interaction…

How to fix or mitigate CVE-2025-43186?

Within 24 hours: Inventory all affected Apple devices (iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6/Sonoma 14.7.7/Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6) in corporate environments and establish monitoring for any suspicious file-parsing behaviors. Within 7 days: Disable or restrict file sharing/parsing features where operationally feasible as interim mitigation. Within 30 days: Deploy security updates immediately upon vendor release and enforce mandatory patching across all affected platforms through Mobile Device Management (MDM) or configuration management systems.

iOS CVE-2025-43186

CRITICAL

Buffer Overflow (CWE-119)

2025-07-30 product-security@apple.com

Apple iOS Memory Corruption Denial Of Service Ipados Iphone Os Tvos Visionos Watchos

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Parsing a file may lead to an unexpected app termination.

AnalysisAI

Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS 18.6, macOS (Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7), tvOS 18.6, visionOS 2.6, and watchOS 11.6. Unauthenticated attackers can trigger arbitrary code execution by delivering a maliciously crafted file requiring no user interaction beyond parsing. Despite CVSS 9.8 critical severity, EPSS score of 0.16% (37th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis and not listed in CISA KEV, suggesting theoretical risk exceeds current real-world threat activity.

Technical ContextAI

This vulnerability stems from CWE-119 (improper restriction on operations within memory buffer bounds), specifically a buffer overflow condition in file parsing routines shared across Apple's operating system ecosystem. The affected components span eight distinct Apple OS platforms, indicating a common parsing library or framework vulnerability in the core system services. Buffer overflows of this class typically occur when input validation fails to properly constrain data written to fixed-size memory buffers during file format interpretation, allowing attackers to overwrite adjacent memory regions. The CVSS vector indicates network-accessible attack surface (AV:N) with low complexity (AC:L), meaning the vulnerability can be triggered remotely without complex timing or environmental prerequisites. The complete absence of privilege requirements (PR:N) and user interaction requirements (UI:N) suggests the vulnerable parsing occurs automatically when processing network-delivered content, potentially through services like mail attachment processing, file sharing protocols, or browser download handlers.

RemediationAI

Vendor-released patches are available for all affected platforms. Users should immediately update to iOS 18.6 and iPadOS 18.6 via Settings > General > Software Update. macOS users should update to Sequoia 15.6, Sonoma 14.7.7, or Ventura 13.7.7 depending on their installed major version through System Settings > General > Software Update. Additional patches include tvOS 18.6, visionOS 2.6, and watchOS 11.6. Apple's coordinated July 2025 security update addresses the vulnerability through improved memory handling per advisory HT215086 and related bulletins. Organizations should prioritize devices with internet exposure or processing untrusted files, while enterprise deployments can leverage mobile device management systems for centralized update deployment. No effective workarounds exist short of disabling file processing capabilities, making patching the only viable mitigation. Full advisory details available at https://support.apple.com/en-us/124147 and subsequent numbered advisories through 124155.