EUVD-2025-209192
GHSA-37mp-2f5m-44h4
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memory corruption.
Analysis
Memory corruption vulnerability in Apple iOS, iPadOS, and macOS allows local attackers to achieve denial of service or potentially arbitrary code execution through malicious file processing. The vulnerability affects iOS and iPadOS versions below 18.6 and macOS Sequoia below 15.6, and has been patched in iOS 18.6, iPadOS 18.6, and macOS Sequoia 15.6. No public exploit identified at time of analysis, and CVSS severity is not numerically specified by Apple, though the buffer overflow classification and file processing attack vector indicate moderate to high real-world risk for users who encounter malicious content.
Technical Context
This vulnerability is a buffer overflow or memory corruption flaw (as indicated by the buffer overflow tag and memory handling focus) triggered during file processing operations across Apple's core operating systems. The vulnerability exists in shared code or libraries used across iOS/iPadOS and macOS platforms, affecting CPE designations for both product lines. The root cause involves improper bounds checking or memory management during file parsing or handling, allowing attackers to write beyond allocated memory boundaries. The file processing attack vector suggests the vulnerability may be triggered through document formats, media files, or other file types handled by system frameworks, making it reachable by local code execution or through user interaction with untrusted content.
Affected Products
Apple iOS versions prior to 18.6 (CPE: cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), Apple iPadOS versions prior to 18.6 (same CPE designator), and Apple macOS Sequoia versions prior to 15.6 (CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) are vulnerable. The EUVD advisory confirms that the vulnerable version ranges are macOS 0 to <15.6 and iOS and iPadOS 0 to <18.6. All users running unpatched versions within these ranges are affected regardless of device model. Refer to Apple support document 124147 (iOS/iPadOS advisory) and 124149 (macOS advisory) for detailed product mapping and release notes.
Remediation
Update immediately to iOS 18.6 or later, iPadOS 18.6 or later, or macOS Sequoia 15.6 or later. Vendor-released patches are available: Apple iOS 18.6, Apple iPadOS 18.6, and Apple macOS Sequoia 15.6 contain the fix. Users should navigate to Settings > General > Software Update on iOS/iPadOS devices or System Settings > General > Software Update on macOS to obtain and install the patched versions. For organizations managing multiple devices, MDM solutions can enforce automatic updates. Until patching is completed, users should avoid opening files of unknown or untrusted origin, particularly document, media, and archive formats that trigger file processing. Detailed update instructions and verification guidance are available at https://support.apple.com/en-us/124147 (iOS/iPadOS) and https://support.apple.com/en-us/124149 (macOS).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today