CVE-2025-43494
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Description
A mail header parsing issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An attacker may be able to cause a persistent denial-of-service.
Analysis
Mail header parsing flaw in Apple operating systems allows unauthenticated remote attackers to trigger persistent denial-of-service conditions across iOS, iPadOS, macOS, visionOS, and watchOS platforms. The vulnerability affects all major Apple OS releases prior to January 2025 patches (iOS/iPadOS 18.7.2/26.1, macOS Sequoia 15.7.2/Sonoma 14.8.2/Tahoe 26.1, visionOS 26.1, watchOS 26.1). With EPSS exploitation probability at 0.19% (41st percentile) and no public exploit identified at time of analysis, real-world risk appears moderate despite the 7.5 CVSS score.
Technical Context
This vulnerability stems from improper input validation (CWE-20) in Apple's mail header parsing routines, a component shared across the company's ecosystem. Mail header parsing is critical for email client functionality, processing MIME headers, RFC 5322 fields, and metadata before message rendering. The flaw allows malformed or specially crafted email headers to trigger resource exhaustion or infinite loops in the parsing logic. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the vulnerability exists in network-accessible mail processing code that executes automatically without user interaction, likely within the system's mail daemon or framework-level email handling services used by Mail.app and other email clients.
Affected Products
The vulnerability impacts Apple iOS versions prior to 18.7.2 and 26.1, iPadOS versions prior to 18.7.2 and 26.1, macOS Sequoia prior to 15.7.2, macOS Sonoma prior to 14.8.2, macOS Tahoe prior to 26.1, visionOS prior to 26.1, and watchOS prior to 26.1. The CPE data confirms broad platform exposure across iPhone OS (cpe:2.3:o:apple:iphone_os), iPadOS (cpe:2.3:o:apple:ipados), macOS (cpe:2.3:o:apple:macos), visionOS (cpe:2.3:o:apple:visionos), and watchOS (cpe:2.3:o:apple:watchos). Official vendor advisories available at https://support.apple.com/en-us/125632 through 125639 provide platform-specific guidance.
Remediation
Apply vendor-released patches immediately by upgrading to the fixed versions: iOS 18.7.2 or iOS 26.1, iPadOS 18.7.2 or iPadOS 26.1, macOS Sequoia 15.7.2 or macOS Tahoe 26.1, macOS Sonoma 14.8.2, visionOS 26.1, and watchOS 26.1. Updates can be installed through System Settings on macOS (System Preferences > Software Update) or Settings > General > Software Update on iOS/iPadOS devices. For environments unable to patch immediately, consider email filtering rules to block messages with anomalous header structures, though this provides incomplete protection and should only be temporary. Complete advisory details and update instructions available at https://support.apple.com/en-us/125632, https://support.apple.com/en-us/125633, https://support.apple.com/en-us/125634, https://support.apple.com/en-us/125635, https://support.apple.com/en-us/125636, https://support.apple.com/en-us/125638, and https://support.apple.com/en-us/125639.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today