What is the CVSS score of CVE-2025-43494?

CVE-2025-43494 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of iOS are affected by CVE-2025-43494?

CVE-2025-43494 is a mail header parsing vulnerability affecting all major Apple operating systems that allows unauthenticated attackers to cause persistent denial-of-service conditions.

iOS CVE-2025-43494

Q: How to fix or mitigate CVE-2025-43494?

Within 24 hours: Inventory all Apple devices across iOS, iPadOS, macOS, visionOS, and watchOS in your organization and identify current OS versions. Within 7 days: Prioritize deployment of vendor-released patches-iOS/iPadOS 18.7.2 or 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1, and watchOS 26.1-to all business-critical devices and user endpoints. Within 30 days: Complete patch deployment across all remaining Apple devices and verify patch installation through mobile device management (MDM) or endpoint management tools.

HIGH

Improper Input Validation (CWE-20)

2025-12-12 product-security@apple.com

Apple iOS macOS Denial Of Service Ipados Iphone Os Visionos Watchos

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Dec 12, 2025 - 21:15 nvd

HIGH 7.5

DescriptionCVE.org

A mail header parsing issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An attacker may be able to cause a persistent denial-of-service.

AnalysisAI

Mail header parsing flaw in Apple operating systems allows unauthenticated remote attackers to trigger persistent denial-of-service conditions across iOS, iPadOS, macOS, visionOS, and watchOS platforms. The vulnerability affects all major Apple OS releases prior to January 2025 patches (iOS/iPadOS 18.7.2/26.1, macOS Sequoia 15.7.2/Sonoma 14.8.2/Tahoe 26.1, visionOS 26.1, watchOS 26.1). With EPSS exploitation probability at 0.19% (41st percentile) and no public exploit identified at time of analysis, real-world risk appears moderate despite the 7.5 CVSS score.

Technical ContextAI

This vulnerability stems from improper input validation (CWE-20) in Apple's mail header parsing routines, a component shared across the company's ecosystem. Mail header parsing is critical for email client functionality, processing MIME headers, RFC 5322 fields, and metadata before message rendering. The flaw allows malformed or specially crafted email headers to trigger resource exhaustion or infinite loops in the parsing logic. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the vulnerability exists in network-accessible mail processing code that executes automatically without user interaction, likely within the system's mail daemon or framework-level email handling services used by Mail.app and other email clients.

RemediationAI

Apply vendor-released patches immediately by upgrading to the fixed versions: iOS 18.7.2 or iOS 26.1, iPadOS 18.7.2 or iPadOS 26.1, macOS Sequoia 15.7.2 or macOS Tahoe 26.1, macOS Sonoma 14.8.2, visionOS 26.1, and watchOS 26.1. Updates can be installed through System Settings on macOS (System Preferences > Software Update) or Settings > General > Software Update on iOS/iPadOS devices. For environments unable to patch immediately, consider email filtering rules to block messages with anomalous header structures, though this provides incomplete protection and should only be temporary. Complete advisory details and update instructions available at https://support.apple.com/en-us/125632, https://support.apple.com/en-us/125633, https://support.apple.com/en-us/125634, https://support.apple.com/en-us/125635, https://support.apple.com/en-us/125636, https://support.apple.com/en-us/125638, and https://support.apple.com/en-us/125639.