iOS CVE-2025-43234

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates a remotely exploitable vulnerability with low attack complexity requiring no authentication or user interaction, yielding a critical 9.8 score with complete impact to confidentiality, integrity, and availability. However, real-world risk assessment reveals important nuances. The EPSS score of 0.18% (40th percentile) suggests security researchers and threat actors currently assess exploitation probability as relatively low despite the theoretical severity. No confirmed actively exploited status exists per CISA KEV, and no public exploit identified at time of analysis. The practical attack surface requires delivering malicious texture data to vulnerable applications, most commonly through web browsers rendering WebGL content, messaging apps processing images, or applications opening untrusted 3D model files. The UI:N rating appears optimistic given that most exploitation scenarios would require some application interaction with attacker-controlled content, though automated processing pipelines could be vulnerable. SSVC decision framework considerations: exploitation is publicly known (CVE published) but not active, the vulnerability is not directly automatable (requires content delivery through specific applications), and technical impact is total system compromise. Priority should be high for internet-facing systems processing untrusted graphics content, moderate for general endpoints with standard patch cycles.

An attacker hosts a malicious WebGL application or sends a specially crafted 3D model file (GLB, USDZ, or texture asset) via messaging platforms or email attachments. When the victim's device processes the malformed texture through Safari, Messages, Quick Look, or any application utilizing Apple's graphics frameworks, the improper input validation triggers memory corruption allowing the attacker to execute arbitrary code with the privileges of the processing application. In a more sophisticated attack, malicious advertisements embedding crafted textures could achieve drive-by compromise of devices simply browsing websites, though the UI:N requirement suggests automated processing contexts may be more reliable exploitation vectors than user-initiated file opening.