What is the CVSS score of CVE-2025-43193?

CVE-2025-43193 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of macOS are affected by CVE-2025-43193?

CVE-2025-43193 is a critical memory handling vulnerability in macOS (Sequoia 15.x, Sonoma 14.x, Ventura 13.x) that enables remote denial-of-service attacks without authentication, potentially…

How to fix or mitigate CVE-2025-43193?

Within 24 hours: Identify and inventory all macOS endpoints running Sequoia 15.x, Sonoma 14.x, or Ventura 13.x in your environment; document findings in your asset management system. Within 7 days: Implement network segmentation and application allowlisting policies to restrict execution of untrusted applications on affected systems; enable enhanced system monitoring for crashes or performance anomalies. Within 30 days: Monitor Apple's security advisory channels for patch release information (target July 2025 security updates); prepare a phased update plan for affected macOS versions once patches are released.

macOS CVE-2025-43193

CRITICAL

Uncontrolled Resource Consumption (CWE-400)

2025-07-30 product-security@apple.com

Apple macOS Denial Of Service

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause a denial-of-service.

AnalysisAI

Memory handling flaw in macOS allows remote denial-of-service via malicious application, affecting Sequoia 15.x, Sonoma 14.x, and Ventura 13.x systems prior to July 2025 security updates. Despite a critical 9.8 CVSS score indicating network-accessible attack with no authentication required, EPSS probability is low (0.10%, 27th percentile) and no public exploit identified at time of analysis. The severity rating appears inconsistent with the described impact (DoS only, no code execution), suggesting CVSS vector may require validation against actual attack requirements.

Technical ContextAI

This vulnerability stems from CWE-400 (Uncontrolled Resource Consumption) due to improper memory handling in macOS kernel or system-level components. The flaw allows an application to exhaust system resources, triggering denial-of-service conditions. Affected products span three major macOS releases: Ventura 13.x (prior to 13.7.7), Sonoma 14.x (prior to 14.7.7), and Sequoia 15.x (prior to 15.6). Apple addressed the issue through improved memory management controls, likely implementing resource limits, bounds checking, or allocation safeguards to prevent malicious applications from depleting memory resources. The vulnerability resides in core operating system functionality shared across multiple macOS generations, suggesting a long-standing architectural weakness rather than a recent regression.

RemediationAI

Vendor-released patches are available for all affected macOS versions. Upgrade macOS Sequoia systems to version 15.6 or later, macOS Sonoma systems to version 14.7.7 or later, and macOS Ventura systems to version 13.7.7 or later. Apply updates through System Settings > General > Software Update or via Apple's enterprise deployment tools for managed environments. Complete advisory details and installation instructions are available at Apple support pages: https://support.apple.com/en-us/124149 (Sequoia 15.6), https://support.apple.com/en-us/124150 (Sonoma 14.7.7), and https://support.apple.com/en-us/124151 (Ventura 13.7.7). No workarounds are documented; patching is the only effective mitigation. Organizations should prioritize systems exposed to untrusted applications or multi-user environments where malicious software installation is feasible.