CVE-2025-43221
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Lifecycle Timeline
2Tags
Description
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
Analysis
Out-of-bounds read vulnerability in Apple media processing frameworks allows local attackers to cause application crashes or disclose sensitive process memory by tricking users into opening malicious media files. Affects iOS/iPadOS 18.x, macOS Sequoia 15.x, tvOS 18.x, and visionOS 2.x prior to July 2025 security updates. No public exploit identified at time of analysis, with EPSS score of 0.02% indicating minimal observed exploitation activity. User interaction required (opening crafted file) reduces immediate risk despite 7.1 CVSS score.
Technical Context
This vulnerability represents a CWE-125 out-of-bounds read flaw in Apple's media file parsing subsystems across multiple operating systems. When processing specially crafted media files, the affected media frameworks read beyond allocated buffer boundaries due to insufficient bounds validation. The flaw impacts the core media handling stack shared across Apple's ecosystem (iOS/iPadOS, macOS, tvOS, and visionOS), suggesting the vulnerable code exists in a common framework like AVFoundation, CoreMedia, or related media codec libraries. Out-of-bounds reads can expose arbitrary process memory contents to attackers, potentially leaking sensitive data such as cryptographic keys, authentication tokens, or other in-memory secrets. The local attack vector (AV:L) indicates exploitation requires the malicious media file to be processed on the victim's device, while the high confidentiality impact (C:H) reflects the potential for significant information disclosure through memory content exposure.
Affected Products
Apple iOS versions prior to 18.6, iPadOS versions prior to 18.6, macOS Sequoia versions prior to 15.6, tvOS versions prior to 18.6, and visionOS versions prior to 2.6 are affected by this out-of-bounds read vulnerability in media processing frameworks. The vulnerability impacts all devices running these operating system versions, including iPhones, iPads, Mac computers running macOS Sequoia, Apple TV devices, and Apple Vision Pro headsets. Official vendor advisories are available at support.apple.com references 124147, 124149, 124153, and 124154 providing platform-specific details.
Remediation
Apply vendor-released patches immediately by updating to iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, or visionOS 2.6 as appropriate for your device platform. These updates include improved bounds checking that resolves the out-of-bounds read condition in media processing code. Updates can be installed through System Settings on each platform or via Apple's enterprise management tools for organizational deployments. Complete advisory details and download links are available at https://support.apple.com/en-us/124147 (iOS/iPadOS), https://support.apple.com/en-us/124149 (macOS), https://support.apple.com/en-us/124153 (tvOS), and https://support.apple.com/en-us/124154 (visionOS). No effective workarounds exist beyond avoiding opening media files from untrusted sources until patches are applied, which is not practical for most users given the ubiquity of media content.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today