CVE-2025-43254
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Lifecycle Timeline
2Tags
Description
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Processing a maliciously crafted file may lead to unexpected app termination.
Analysis
Out-of-bounds read in macOS file processing can expose sensitive memory and crash applications when victims open maliciously crafted files. Affects macOS Ventura 13.x, Sonoma 14.x, and Sequoia 15.x prior to patched versions (13.7.7, 14.7.7, 15.6 respectively). Requires local access and user interaction (CVSS AV:L/UI:R). EPSS score of 0.02% (4th percentile) indicates minimal observed exploitation likelihood. No CISA KEV listing or public exploit identified at time of analysis, suggesting low immediate threat despite CVSS 7.1 rating.
Technical Context
This vulnerability stems from a classic buffer read overflow (CWE-125) in macOS file parsing logic, where insufficient input validation allows specially crafted file structures to trigger reads beyond allocated memory boundaries. The out-of-bounds read can expose confidential memory contents (CVSS C:H) and cause application crashes through memory corruption (CVSS A:H). Affects three major macOS CPE product lines across enterprise and consumer deployments. The CWE-125 classification indicates the flaw does not permit memory writes, limiting exploitation to information disclosure and denial-of-service scenarios rather than arbitrary code execution. Apple's fix involved improved input validation to enforce proper bounds checking during file parsing operations, a standard mitigation for buffer read vulnerabilities.
Affected Products
Apple macOS across three major release branches: macOS Ventura 13.x (versions prior to 13.7.7 as identified by CPE 2.3:o:apple:macos covering the 13.x range), macOS Sonoma 14.x (versions before 14.7.7), and macOS Sequoia 15.x (versions prior to 15.6). The vulnerability affects all macOS installations running unpatched versions within these product lines, spanning enterprise managed deployments and consumer endpoints. Official vendor advisories detail affected version ranges at support.apple.com/en-us/124149 (Sequoia), support.apple.com/en-us/124150 (Sonoma), and support.apple.com/en-us/124151 (Ventura).
Remediation
Apply vendor-released patches immediately through standard macOS software update mechanisms: upgrade macOS Sequoia installations to version 15.6 or later, macOS Sonoma systems to 14.7.7 or later, and macOS Ventura endpoints to 13.7.7 or later. Patches available via System Settings > General > Software Update or through enterprise management tools like Jamf Pro or Intune. Complete patch details and installation guidance provided in Apple security advisories at https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124150, and https://support.apple.com/en-us/124151. No workarounds identified as effective alternatives to patching. Organizations should prioritize patch deployment to systems processing untrusted files or documents from external sources. FullDisclosure mailing list archives at http://seclists.org/fulldisclosure/2025/Jul/32-34 provide additional technical discussion for security researchers investigating the vulnerability characteristics.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today