CVE-2025-43193
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause a denial-of-service.
Analysis
Memory handling flaw in macOS allows remote denial-of-service via malicious application, affecting Sequoia 15.x, Sonoma 14.x, and Ventura 13.x systems prior to July 2025 security updates. Despite a critical 9.8 CVSS score indicating network-accessible attack with no authentication required, EPSS probability is low (0.10%, 27th percentile) and no public exploit identified at time of analysis. The severity rating appears inconsistent with the described impact (DoS only, no code execution), suggesting CVSS vector may require validation against actual attack requirements.
Technical Context
This vulnerability stems from CWE-400 (Uncontrolled Resource Consumption) due to improper memory handling in macOS kernel or system-level components. The flaw allows an application to exhaust system resources, triggering denial-of-service conditions. Affected products span three major macOS releases: Ventura 13.x (prior to 13.7.7), Sonoma 14.x (prior to 14.7.7), and Sequoia 15.x (prior to 15.6). Apple addressed the issue through improved memory management controls, likely implementing resource limits, bounds checking, or allocation safeguards to prevent malicious applications from depleting memory resources. The vulnerability resides in core operating system functionality shared across multiple macOS generations, suggesting a long-standing architectural weakness rather than a recent regression.
Affected Products
Apple macOS across three major release branches requires patching: macOS Sequoia versions prior to 15.6, macOS Sonoma versions prior to 14.7.7, and macOS Ventura versions prior to 13.7.7. All systems running these operating systems in enterprise, research, or consumer environments are vulnerable. The CPE identifiers (cpe:2.3:o:apple:macos) confirm broad applicability across the macOS product line without architecture-specific limitations. Apple security advisories HT215230, HT215231, and HT215232 provide version-specific guidance for each affected release branch.
Remediation
Vendor-released patches are available for all affected macOS versions. Upgrade macOS Sequoia systems to version 15.6 or later, macOS Sonoma systems to version 14.7.7 or later, and macOS Ventura systems to version 13.7.7 or later. Apply updates through System Settings > General > Software Update or via Apple's enterprise deployment tools for managed environments. Complete advisory details and installation instructions are available at Apple support pages: https://support.apple.com/en-us/124149 (Sequoia 15.6), https://support.apple.com/en-us/124150 (Sonoma 14.7.7), and https://support.apple.com/en-us/124151 (Ventura 13.7.7). No workarounds are documented; patching is the only effective mitigation. Organizations should prioritize systems exposed to untrusted applications or multi-user environments where malicious software installation is feasible.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today