CVE-2025-43539
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing a file may lead to memory corruption.
Analysis
Memory corruption via out-of-bounds write in Apple operating systems allows remote attackers to execute arbitrary code when victims process a malicious file. The vulnerability affects macOS (Sonoma 14.x, Sequoia 15.x, Tahoe 26.x), iOS/iPadOS (18.x, 26.x), tvOS, visionOS, and watchOS 26.x. Despite a high CVSS score of 8.8, EPSS data indicates only 0.05% exploitation probability (15th percentile), and no public exploit code or active exploitation is confirmed. The flaw stems from inadequate bounds checking (CWE-787) in file processing routines, requiring user interaction but no authentication, making it a realistic phishing or malicious download target.
Technical Context
This vulnerability represents a classic out-of-bounds write condition (CWE-787), also known as a buffer overflow, occurring in Apple's file processing subsystems. The flaw affects the core operating system layer across Apple's entire ecosystem, as indicated by CPE strings targeting macOS broadly without component-specific granularity. When the affected code processes specially crafted file formats, insufficient bounds validation allows data to be written beyond allocated memory boundaries. This class of vulnerability can corrupt adjacent memory structures, function pointers, or critical data, providing attackers control over program execution flow. The cross-platform nature-spanning mobile (iOS/iPadOS), desktop (macOS), embedded (watchOS), mixed reality (visionOS), and media devices (tvOS)-suggests the vulnerable code exists in a shared framework or library used across Apple's unified development environment, potentially CoreFoundation, ImageIO, or similar system-level components responsible for file format parsing.
Affected Products
The vulnerability impacts multiple Apple operating system families across version ranges fixed in January 2025 security updates. Affected products include macOS Sonoma versions prior to 14.8.3, macOS Sequoia versions prior to 15.7.3, macOS Tahoe versions prior to 26.2, iOS and iPadOS versions prior to 18.7.3 and 26.2, tvOS versions prior to 26.2, visionOS versions prior to 26.2, and watchOS versions prior to 26.2. The CPE identifiers (cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*) confirm broad macOS exposure without component-level specificity, indicating the flaw resides in core system libraries rather than optional features. Comprehensive vendor advisories are available at https://support.apple.com/en-us/125884 through https://support.apple.com/en-us/125891 covering each platform's security updates.
Remediation
Immediately update all affected Apple devices to vendor-released patched versions that incorporate improved bounds checking mechanisms. For macOS Sonoma users, upgrade to version 14.8.3 or later; macOS Sequoia users should install version 15.7.3 or later; macOS Tahoe users require version 26.2 or later. iOS and iPadOS devices must be updated to either 18.7.3 or 26.2 depending on device compatibility. Similarly, tvOS, visionOS, and watchOS users should install version 26.2 or later. Organizations can deploy these updates through Mobile Device Management (MDM) systems for centralized patch management. Apple's security updates are available through System Settings > General > Software Update on macOS, and Settings > General > Software Update on iOS/iPadOS devices. Detailed security content documentation and direct download links are provided in Apple's security advisories at https://support.apple.com/en-us/125887 and https://support.apple.com/en-us/125888. No workarounds are published; patching remains the sole effective mitigation. Until patches are deployed, implement defense-in-depth controls including restricting users from opening untrusted files, disabling automatic file preview features, and enforcing strict email attachment policies.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today