What is the CVSS score of CVE-2025-43224?

CVE-2025-43224 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2025-43224?

CVE-2025-43224 is a high-severity out-of-bounds memory access vulnerability affecting Apple's media processing across iOS, iPadOS, macOS, tvOS, and visionOS that could allow local attackers to crash…

How to fix or mitigate CVE-2025-43224?

Within 24 hours: Inventory all Apple devices running iOS/iPadOS versions prior to 18.6, macOS versions prior to Sequoia 15.6, tvOS prior to 18.6, and visionOS prior to 2.6 across your organization. Within 7 days: Develop a phased deployment plan for the vendor-released patches (iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6) prioritizing systems in high-risk environments. Within 30 days: Complete patch deployment to 80% of affected inventory and implement application whitelisting or media file validation controls for any systems unable to patch within the timeline.

iOS CVE-2025-43224

HIGH

Out-of-bounds Write (CWE-787)

2025-07-30 product-security@apple.com

Apple iOS macOS Buffer Overflow Denial Of Service Ipados Iphone Os Tvos Visionos

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

HIGH 7.1

DescriptionCVE.org

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

AnalysisAI

Out-of-bounds memory access in Apple media processing components affects iOS, iPadOS, macOS, tvOS, and visionOS, allowing local attackers to crash applications or corrupt memory via malicious media files. Fixed in iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, and visionOS 2.6. EPSS score of 0.02% (4th percentile) indicates minimal observed exploitation probability, and no public exploit identified at time of analysis, suggesting lower immediate risk despite CVSS 7.1 rating.

Technical ContextAI

This vulnerability stems from CWE-787 (Out-of-bounds Write), a buffer overflow condition in Apple's media file parsing subsystem used across their operating system ecosystem. The affected components include iOS (iPhone OS), iPadOS, macOS Sequoia, tvOS, and visionOS platforms, indicating a shared media processing framework or library vulnerability. Out-of-bounds access occurs when media file parsers fail to validate file structure boundaries before writing to memory buffers, allowing specially crafted media files to write data beyond allocated memory regions. This class of vulnerability is particularly concerning in media processing because media files contain complex nested structures (codecs, containers, metadata) that require extensive parsing. Apple's fix involves improved bounds checking, meaning additional validation logic to ensure array indices and buffer offsets remain within allocated memory regions during media file processing operations.

RemediationAI

Vendor-released patches are available for all affected platforms. Users should immediately update to iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, or visionOS 2.6 through standard system update mechanisms (Settings > General > Software Update on iOS/iPadOS, System Settings > General > Software Update on macOS). These updates include improved bounds checking logic that prevents out-of-bounds memory access during media file processing. Complete vendor security advisories with installation instructions are available at https://support.apple.com/en-us/124147, https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124153, and https://support.apple.com/en-us/124154. No workarounds are provided; patching is the only complete mitigation. Until systems are updated, users should exercise caution when opening media files from untrusted sources, though this provides limited protection against determined social engineering attacks.