CVE-2025-43234
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted texture may lead to unexpected app termination.
Analysis
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allow remote code execution via maliciously crafted texture files. Affects all major Apple platforms prior to July 2025 updates (iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6). Despite a critical CVSS 9.8 score indicating network-exploitable remote code execution without authentication, EPSS shows only 0.18% exploitation probability (40th percentile), and no public exploit identified at time of analysis. The vulnerability requires processing specially crafted texture data, likely through applications handling untrusted image or 3D content.
Technical Context
This vulnerability affects Apple's texture processing subsystem, a graphics framework component responsible for handling texture data across Metal, Core Graphics, and related rendering APIs used throughout Apple's operating systems. The root cause is CWE-20 (Improper Input Validation), specifically multiple buffer overflow conditions occurring when parsing malformed texture file formats. Texture processing involves complex data structures including mipmaps, compression formats (ASTC, BC, ETC), and metadata that must be validated before memory allocation and decompression. The affected CPE entries span Apple's entire ecosystem: iPhone OS (iOS), iPadOS, macOS Sequoia, tvOS, visionOS, and watchOS, indicating a shared codebase vulnerability in a low-level graphics library common to all Apple platforms. The memory corruption occurs during texture decompression or format conversion, where insufficient bounds checking allows attacker-controlled data to corrupt heap or stack memory structures.
Affected Products
Apple iOS versions prior to 18.6, iPadOS versions prior to 18.6, macOS Sequoia versions prior to 15.6, tvOS versions prior to 18.6, visionOS versions prior to 2.6, and watchOS versions prior to 11.6 are affected. The vulnerability impacts the shared graphics texture processing framework used across all Apple operating systems, affecting iPhones, iPads, Mac computers, Apple TVs, Apple Vision Pro headsets, and Apple Watches. According to CPE identifiers cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*, and cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*, all versions prior to the July 2025 security updates contain the memory corruption flaws. Vendor advisories available at support.apple.com/en-us/124147 through 124155 provide platform-specific details.
Remediation
Apply vendor-released patches immediately by updating to iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, or watchOS 11.6 as appropriate for each device. Updates can be installed through Settings > General > Software Update on iOS/iPadOS/visionOS devices, System Settings > General > Software Update on macOS, Settings > System > Software Updates on tvOS and watchOS, or through Apple Configurator for managed deployments. Detailed security content and installation instructions are available in Apple security advisories at https://support.apple.com/en-us/124147, https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124153, https://support.apple.com/en-us/124154, and https://support.apple.com/en-us/124155. No effective workarounds exist for this graphics framework vulnerability short of avoiding all untrusted content processing, which is impractical for most use cases. Organizations should prioritize patching internet-facing systems, devices processing external content, and high-value targets within standard maintenance windows.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today