What is the CVSS score of CVE-2025-43234?

CVE-2025-43234 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of iOS are affected by CVE-2025-43234?

CVE-2025-43234 is a critical memory corruption vulnerability in Apple's graphics texture processing engine affecting all major Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) with a…

How to fix or mitigate CVE-2025-43234?

Within 24 hours: Inventory all Apple devices across the organization and identify systems running pre-July 2025 OS versions; communicate to all users that patch deployment is forthcoming and advise caution with untrusted image/3D files. Within 7 days: Prepare and test deployment packages for iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6 in controlled environments. Within 30 days: Deploy vendor patches across all affected Apple platforms; prioritize production systems and devices with high user access to external content, with completion target before end of July 2025.

iOS CVE-2025-43234

CRITICAL

Improper Input Validation (CWE-20)

2025-07-30 product-security@apple.com

Apple iOS macOS Memory Corruption Denial Of Service Ipados Iphone Os Tvos Visionos Watchos

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted texture may lead to unexpected app termination.

AnalysisAI

Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allow remote code execution via maliciously crafted texture files. Affects all major Apple platforms prior to July 2025 updates (iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6). Despite a critical CVSS 9.8 score indicating network-exploitable remote code execution without authentication, EPSS shows only 0.18% exploitation probability (40th percentile), and no public exploit identified at time of analysis. The vulnerability requires processing specially crafted texture data, likely through applications handling untrusted image or 3D content.

Technical ContextAI

This vulnerability affects Apple's texture processing subsystem, a graphics framework component responsible for handling texture data across Metal, Core Graphics, and related rendering APIs used throughout Apple's operating systems. The root cause is CWE-20 (Improper Input Validation), specifically multiple buffer overflow conditions occurring when parsing malformed texture file formats. Texture processing involves complex data structures including mipmaps, compression formats (ASTC, BC, ETC), and metadata that must be validated before memory allocation and decompression. The affected CPE entries span Apple's entire ecosystem: iPhone OS (iOS), iPadOS, macOS Sequoia, tvOS, visionOS, and watchOS, indicating a shared codebase vulnerability in a low-level graphics library common to all Apple platforms. The memory corruption occurs during texture decompression or format conversion, where insufficient bounds checking allows attacker-controlled data to corrupt heap or stack memory structures.

RemediationAI

Apply vendor-released patches immediately by updating to iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, or watchOS 11.6 as appropriate for each device. Updates can be installed through Settings > General > Software Update on iOS/iPadOS/visionOS devices, System Settings > General > Software Update on macOS, Settings > System > Software Updates on tvOS and watchOS, or through Apple Configurator for managed deployments. Detailed security content and installation instructions are available in Apple security advisories at https://support.apple.com/en-us/124147, https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124153, https://support.apple.com/en-us/124154, and https://support.apple.com/en-us/124155. No effective workarounds exist for this graphics framework vulnerability short of avoiding all untrusted content processing, which is impractical for most use cases. Organizations should prioritize patching internet-facing systems, devices processing external content, and high-value targets within standard maintenance windows.