Watchos
CVE-2025-43520
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Medium-high risk. While exploitation requires local app execution, the kernel-level impact means a successful attack could lead to privilege escalation or persistent compromise. Added to CISA KEV indicates active exploitation. |
| Exploit ScenarioDerived | An attacker distributes a trojanized app through sideloading or a compromised enterprise certificate. Once installed, the app triggers the kernel memory corruption to escalate privileges, bypass sandboxing, and install persistent surveillance implants. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system termination or write kernel memory via an out-of-bounds write flaw addressed in watchOS 26.1, iOS 18.7.2, and macOS Tahoe 26.1.
Earlier versions of this analysis (1)
An out-of-bounds write vulnerability in the Apple kernel affects watchOS, iOS, iPadOS, macOS Tahoe, visionOS, tvOS, macOS Sonoma, and macOS Sequoia, allowing malicious applications to corrupt kernel memory or crash the system.
RemediationAI
Update all Apple devices to the latest OS versions. Enterprise environments should enforce MDM policies requiring minimum OS versions and restrict sideloading of applications.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw (CWE-787) stems from improper memory handling in the kernel, where a malicious app can trigger an out-of-bounds write to kernel memory pages. Apple addressed this with improved memory handling across all affected platforms.
Know when Watchos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.
Executive ViewAI
CVE-2025-43520 is a memory corruption vulnerability affecting multiple Apple platforms that could allow malicious apps to crash systems or access kernel memory. While the vulnerability has a HIGH severity rating, exploitation probability remains extremely low (0.02%), with no current evidence of active attacks or public exploits, making immediate organizational risk manageable.
Implement strict application controls via MDM to prevent installation of untrusted applications; enforce code signing requirements and app store-only installation policies; restrict user permissions and disable developer mode on production devices; segment mobile devices on separate network VLANs; maintain current OS versions to receive security updates promptly when patches are released.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)NVD
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in I
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
GitHub PoC
Exploit-DB