CVE-2025-43282
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Description
A double free issue was addressed with improved memory management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. An app may be able to cause unexpected system termination.
Analysis
Double free memory management vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows local apps to trigger unexpected system termination through memory corruption. Affecting iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, macOS Ventura 13.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. No public exploit code or active exploitation confirmed; EPSS score of 0.01% indicates minimal real-world exploitation probability despite moderate CVSS rating.
Technical Context
Double free vulnerabilities (CWE-415) occur when a program attempts to free allocated memory twice, corrupting the heap allocator's internal state and causing potential crashes or undefined behavior. In this case, Apple's memory management routines failed to properly track or prevent duplicate deallocation of memory blocks, likely within system frameworks used by third-party applications. The vulnerability requires local code execution context (app running on the device) and user interaction to trigger the code path containing the flaw. The CPE data confirms the vulnerability spans all major Apple platforms: iOS, iPadOS, macOS (across multiple versions-Sequoia 15.5 and earlier, Sonoma 14.7.6 and earlier, Ventura 13.7.6 and earlier), tvOS, visionOS, and watchOS.
Affected Products
Apple iOS 18.5 and earlier versions, iPadOS 18.5 and earlier (including iPadOS 17.7.8 and earlier), macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, macOS Ventura 13.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. Specific version information and patch availability is documented in Apple support articles 124147 (iOS/iPadOS), 124148 (macOS Sequoia), 124149 (macOS Sonoma), 124150 (macOS Ventura), 124151 (tvOS), 124153 (visionOS), 124154 (watchOS), and 124155 (additional guidance).
Remediation
Vendor-released patches: iOS 18.6, iPadOS 18.6 and iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Users should immediately apply the available system updates through Settings > General > Software Update on iOS/iPadOS/tvOS/visionOS/watchOS, or System Settings > General > Software Update on macOS. Apple has provided comprehensive guidance through its security advisories (support.apple.com articles 124147-124155). No workarounds are available; patching is the only mitigation. For enterprise deployments, MDM solutions can enforce update deployment to managed devices.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today