What is the CVSS score of CVE-2025-43277?

CVE-2025-43277 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2025-43277?

CVE-2025-43277 is a memory corruption vulnerability in Apple's audio processing framework affecting iOS, macOS, tvOS, visionOS, and watchOS that allows local attackers to execute arbitrary code…

iOS CVE-2025-43277

Q: How to fix or mitigate CVE-2025-43277?

Within 24 hours: Inventory all Apple devices across iOS, macOS, tvOS, visionOS, and watchOS in your environment and identify which versions require updates. Within 7 days: Deploy available patches-iOS/iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.8, tvOS 18.6, visionOS 2.6, and watchOS 11.6-prioritizing user-facing devices and high-risk endpoints. Within 30 days: Complete full deployment across all in-scope systems and validate patch application through Mobile Device Management (MDM) or endpoint management tools.

HIGH

Buffer Overflow (CWE-119)

2025-07-30 product-security@apple.com

Apple iOS macOS Memory Corruption

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

HIGH 7.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.8, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted audio file may lead to memory corruption.

AnalysisAI

Memory corruption in Apple's audio processing framework across iOS, macOS, tvOS, visionOS, and watchOS allows local attackers to achieve arbitrary code execution by tricking users into opening malicious audio files. Fixed in iOS/iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.8, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Despite a high CVSS score of 7.8, the 2% EPSS probability indicates low observed exploitation likelihood, with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

This vulnerability represents a buffer overflow (CWE-119) in Apple's audio file parsing subsystem, which is shared across the entire Apple ecosystem including macOS, iOS, iPadOS, tvOS, visionOS, and watchOS. Audio file parsers are notoriously complex due to the variety of codec formats, container structures, and metadata fields they must handle. The memory handling flaw likely occurs during the parsing or decoding phase when processing specially crafted audio file headers, metadata chunks, or compressed audio streams. Buffer overflows in media parsers can allow attackers to overwrite adjacent memory regions with controlled data, potentially hijacking program execution flow. The cross-platform nature indicated by the CPE data (cpe:2.3:o:apple:macos) and Apple's simultaneous patching across all operating systems suggests the vulnerable code exists in a shared framework, potentially AudioToolbox or Core Audio components that handle format detection and decoding operations common to all Apple platforms.

RemediationAI

Apply vendor-released patches immediately by updating to iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.8, tvOS 18.6, visionOS 2.6, or watchOS 11.6 as appropriate for your platform. Apple addressed the vulnerability through improved memory handling in the audio processing framework. Installation instructions and update packages are available through standard Apple Software Update mechanisms or from the security advisories at support.apple.com/en-us/125112 and related platform-specific bulletins (124147, 124149, 124153, 124154, 124155). As an interim mitigation until patching is complete, users should avoid opening audio files from untrusted sources or unknown senders, though this workaround is not a substitute for applying the security update. Organizations should prioritize patching user-facing devices where employees regularly handle external media files, particularly in creative, media production, or customer support roles.