iOS CVE-2025-43209
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
AnalysisAI
Out-of-bounds write vulnerability in WebKit across Apple's entire operating system ecosystem allows remote code execution via maliciously crafted web content without user interaction or authentication. Affects iOS, iPadOS, macOS (Ventura through Sequoia), tvOS, visionOS, and watchOS prior to July 2025 security updates. Despite a critical 9.8 CVSS score indicating maximum severity, EPSS probability remains low at 0.14% (34th percentile), and no public exploit identified at time of analysis, suggesting limited observed exploitation attempts despite the theoretical remote attack surface.
Technical ContextAI
This vulnerability stems from an out-of-bounds write condition (CWE-787) in WebKit, Apple's browser engine used across all Apple platforms for rendering web content in Safari and embedded web views. Out-of-bounds writes occur when memory is written beyond allocated buffer boundaries, enabling memory corruption that attackers can leverage for arbitrary code execution. The issue affects the web content processing pipeline, where insufficient bounds checking allowed malicious HTML, CSS, or JavaScript to trigger writes outside intended memory regions. The vulnerability exists in WebKit components shared across iOS 18.x, iPadOS 17.x/18.x, macOS 13.x (Ventura), 14.x (Sonoma), and 15.x (Sequoia), tvOS 18.x, visionOS 2.x, and watchOS 11.x, indicating a core flaw in shared rendering engine code predating the platform-specific implementations.
RemediationAI
Apply vendor-released patches immediately by updating to the fixed versions: iOS 18.6, iPadOS 17.7.9 or 18.6 (depending on device model), macOS Ventura 13.7.7, macOS Sonoma 14.7.7, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, or watchOS 11.6. Updates can be installed through system Settings > General > Software Update on respective devices. Organizations managing Apple fleets should deploy updates via MDM solutions. Detailed security content is documented in Apple support articles at https://support.apple.com/en-us/124147 through https://support.apple.com/en-us/124155. No workarounds are provided; patching is the only mitigation as the vulnerability exists in core web rendering functionality that cannot be disabled without breaking Safari and embedded web view functionality across applications.
More from same product – last 7 days
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Dock
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape
Local privilege escalation in Apple macOS allows a malicious app already running with low privileges to elevate to root
Local privilege escalation in Canonical Multipass for macOS before 1.16.3 allows a low-privileged local user to obtain r
Share
External POC / Exploit Code
Leaving vuln.today