iOS
CVE-2025-43532
LOW
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing malicious data may lead to unexpected app termination.
AnalysisAI
Memory corruption in Apple operating systems due to insufficient bounds checking allows local authenticated users to cause denial of service through malicious data processing, affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability requires local access and user interaction, with no public exploit identified; EPSS score of 0.02% indicates minimal real-world exploitation probability despite the assigned CVSS score of 2.8.
Technical ContextAI
CVE-2025-43532 is classified as CWE-120 (Buffer Overflow), indicating a failure to properly validate buffer boundaries during memory operations. The vulnerability exists in one or more of Apple's core operating system components shared across iOS, iPadOS, macOS (Sequoia 15.x, Sonoma 14.x, Tahoe 26.x), tvOS, visionOS, and watchOS. When a local process with limited privileges processes specially crafted input data, the bounds checking mechanism fails to prevent out-of-bounds memory access, resulting in application-level memory corruption. The vulnerability is triggered only when a user interacts with the malicious data (UI:R requirement in CVSS vector), limiting its attack surface.
RemediationAI
Vendor-released patches are available: update to iOS 18.7.3 or later, iPadOS 18.7.3 or later, iOS 26.2 or later, iPadOS 26.2 or later, macOS Sequoia 15.7.3 or later, macOS Sonoma 14.8.3 or later, macOS Tahoe 26.2 or later, tvOS 26.2 or later, visionOS 26.2 or later, or watchOS 26.2 or later depending on device type. Consult Apple's security advisories at the referenced support pages for version-specific update instructions. Since the vulnerability requires local access and user interaction to trigger, interim risk is minimal for systems with restricted local access controls and user privilege separation.
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today