What is the CVSS score of CVE-2025-43202?

CVE-2025-43202 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by CVE-2025-43202?

CVE-2025-43202 is a local memory corruption vulnerability affecting Apple iOS, iPadOS, and macOS that could enable denial of service or arbitrary code execution through malicious file processing.. A patch is available.

How to fix or mitigate CVE-2025-43202?

Within 24 hours: Identify all iOS, iPadOS, and macOS devices in your environment running versions below 18.6 (iOS/iPadOS) and 15.6 (macOS Sequoia). Within 7 days: Deploy iOS 18.6, iPadOS 18.6, and macOS Sequoia 15.6 patches through your mobile device management (MDM) or standard Apple update mechanisms; prioritize devices with elevated user privileges or sensitive data access. Within 30 days: Verify 100% deployment completion through MDM reporting and confirm all legacy OS versions no longer in use have been retired or further hardened with compensating controls.

Apple CVE-2025-43202

EUVD-2025-209192 HIGH

Out-of-bounds Write (CWE-787)

2026-04-02 apple

GHSA-37mp-2f5m-44h4

Apple Buffer Overflow Memory Corruption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:08 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

15.6,18.6

EUVD ID Assigned

Apr 02, 2026 - 19:01 euvd

EUVD-2025-209192

Analysis Generated

Apr 02, 2026 - 19:01 vuln.today

CVE Published

Apr 02, 2026 - 18:10 nvd

HIGH 8.8

DescriptionCVE.org

This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memory corruption.

AnalysisAI

Memory corruption vulnerability in Apple iOS, iPadOS, and macOS allows local attackers to achieve denial of service or potentially arbitrary code execution through malicious file processing. The vulnerability affects iOS and iPadOS versions below 18.6 and macOS Sequoia below 15.6, and has been patched in iOS 18.6, iPadOS 18.6, and macOS Sequoia 15.6. No public exploit identified at time of analysis, and CVSS severity is not numerically specified by Apple, though the buffer overflow classification and file processing attack vector indicate moderate to high real-world risk for users who encounter malicious content.

Technical ContextAI

This vulnerability is a buffer overflow or memory corruption flaw (as indicated by the buffer overflow tag and memory handling focus) triggered during file processing operations across Apple's core operating systems. The vulnerability exists in shared code or libraries used across iOS/iPadOS and macOS platforms, affecting CPE designations for both product lines. The root cause involves improper bounds checking or memory management during file parsing or handling, allowing attackers to write beyond allocated memory boundaries. The file processing attack vector suggests the vulnerability may be triggered through document formats, media files, or other file types handled by system frameworks, making it reachable by local code execution or through user interaction with untrusted content.

RemediationAI

Update immediately to iOS 18.6 or later, iPadOS 18.6 or later, or macOS Sequoia 15.6 or later. Vendor-released patches are available: Apple iOS 18.6, Apple iPadOS 18.6, and Apple macOS Sequoia 15.6 contain the fix. Users should navigate to Settings > General > Software Update on iOS/iPadOS devices or System Settings > General > Software Update on macOS to obtain and install the patched versions. For organizations managing multiple devices, MDM solutions can enforce automatic updates. Until patching is completed, users should avoid opening files of unknown or untrusted origin, particularly document, media, and archive formats that trigger file processing. Detailed update instructions and verification guidance are available at https://support.apple.com/en-us/124147 (iOS/iPadOS) and https://support.apple.com/en-us/124149 (macOS).