Skip to main content

iOS CVE-2025-43282

MEDIUM
Double Free (CWE-415)
2025-10-15 product-security@apple.com
Apple iOS macOS Memory Corruption Denial Of Service Ipados Iphone Os Tvos Visionos Watchos
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Apr 02, 2026 - 19:37 vuln.today
CVE Published
Oct 15, 2025 - 20:15 nvd
MEDIUM 5.5

DescriptionCVE.org

A double free issue was addressed with improved memory management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. An app may be able to cause unexpected system termination.

AnalysisAI

Double free memory management vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows local apps to trigger unexpected system termination through memory corruption. Affecting iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, macOS Ventura 13.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. No public exploit code or active exploitation confirmed; EPSS score of 0.01% indicates minimal real-world exploitation probability despite moderate CVSS rating.

Technical ContextAI

Double free vulnerabilities (CWE-415) occur when a program attempts to free allocated memory twice, corrupting the heap allocator's internal state and causing potential crashes or undefined behavior. In this case, Apple's memory management routines failed to properly track or prevent duplicate deallocation of memory blocks, likely within system frameworks used by third-party applications. The vulnerability requires local code execution context (app running on the device) and user interaction to trigger the code path containing the flaw. The CPE data confirms the vulnerability spans all major Apple platforms: iOS, iPadOS, macOS (across multiple versions-Sequoia 15.5 and earlier, Sonoma 14.7.6 and earlier, Ventura 13.7.6 and earlier), tvOS, visionOS, and watchOS.

RemediationAI

Vendor-released patches: iOS 18.6, iPadOS 18.6 and iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Users should immediately apply the available system updates through Settings > General > Software Update on iOS/iPadOS/tvOS/visionOS/watchOS, or System Settings > General > Software Update on macOS. Apple has provided comprehensive guidance through its security advisories (support.apple.com articles 124147-124155). No workarounds are available; patching is the only mitigation. For enterprise deployments, MDM solutions can enforce update deployment to managed devices.

More in iOS

View all
CVE-2023-43000 HIGH POC
8.8 Nov 05

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
CVE-2026-20700 HIGH POC
7.8 Feb 11

Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
CVE-2023-41974 HIGH POC
7.8 Jan 10

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
CVE-2014-7992 MEDIUM POC
5.0 Nov 18

The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
CVE-2022-48618 HIGH
7.0 Jan 09

The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)

CVE-2025-66555 HIGH POC
8.8 Dec 04

AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type

CVE-2025-46335 HIGH POC
8.6 May 05

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
CVE-2021-1385 MEDIUM POC
6.5 Mar 24

A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
CVE-2026-31852 CRITICAL
10.0 Mar 11

Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
CVE-2025-43234 CRITICAL
9.8 Jul 30

Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
CVE-2025-43186 CRITICAL
9.8 Jul 30

Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS

CVE-2023-40414 CRITICAL
9.8 Jan 10

A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2023-25136 MEDIUM POC
6.5
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8
CVE-2017-6074 HIGH POC
7.8
CVE-2017-9287 MEDIUM POC
6.5

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2025-43282 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy