What is the CVSS score of CVE-2025-43209?

CVE-2025-43209 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of iOS are affected by CVE-2025-43209?

CVE-2025-43209 is a critical remote code execution vulnerability in WebKit affecting all Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) that allows unauthenticated attackers to…

How to fix or mitigate CVE-2025-43209?

Within 24 hours: Inventory all Apple devices across the organization (iOS, iPadOS, macOS Ventura-Sequoia, tvOS, visionOS, watchOS) and assess criticality tier (production, development, user endpoints). Within 7 days: Implement compensating controls-restrict web browsing through managed network proxies with content filtering, disable JavaScript where operationally feasible, and isolate affected high-risk devices from sensitive systems. Within 30 days: Apply July 2025 security updates or later releases for all affected Apple platforms as they become available from Apple; prioritize macOS Sequoia systems and any devices with network access to sensitive data.

iOS CVE-2025-43209

CRITICAL

Out-of-bounds Write (CWE-787)

2025-07-30 product-security@apple.com

Apple iOS macOS Safari Memory Corruption Denial Of Service Ipados Iphone Os Tvos Visionos Watchos

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

CRITICAL 9.8

DescriptionCVE.org

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.

AnalysisAI

Out-of-bounds write vulnerability in WebKit across Apple's entire operating system ecosystem allows remote code execution via maliciously crafted web content without user interaction or authentication. Affects iOS, iPadOS, macOS (Ventura through Sequoia), tvOS, visionOS, and watchOS prior to July 2025 security updates. Despite a critical 9.8 CVSS score indicating maximum severity, EPSS probability remains low at 0.14% (34th percentile), and no public exploit identified at time of analysis, suggesting limited observed exploitation attempts despite the theoretical remote attack surface.

Technical ContextAI

This vulnerability stems from an out-of-bounds write condition (CWE-787) in WebKit, Apple's browser engine used across all Apple platforms for rendering web content in Safari and embedded web views. Out-of-bounds writes occur when memory is written beyond allocated buffer boundaries, enabling memory corruption that attackers can leverage for arbitrary code execution. The issue affects the web content processing pipeline, where insufficient bounds checking allowed malicious HTML, CSS, or JavaScript to trigger writes outside intended memory regions. The vulnerability exists in WebKit components shared across iOS 18.x, iPadOS 17.x/18.x, macOS 13.x (Ventura), 14.x (Sonoma), and 15.x (Sequoia), tvOS 18.x, visionOS 2.x, and watchOS 11.x, indicating a core flaw in shared rendering engine code predating the platform-specific implementations.

RemediationAI

Apply vendor-released patches immediately by updating to the fixed versions: iOS 18.6, iPadOS 17.7.9 or 18.6 (depending on device model), macOS Ventura 13.7.7, macOS Sonoma 14.7.7, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, or watchOS 11.6. Updates can be installed through system Settings > General > Software Update on respective devices. Organizations managing Apple fleets should deploy updates via MDM solutions. Detailed security content is documented in Apple support articles at https://support.apple.com/en-us/124147 through https://support.apple.com/en-us/124155. No workarounds are provided; patching is the only mitigation as the vulnerability exists in core web rendering functionality that cannot be disabled without breaking Safari and embedded web view functionality across applications.