CVE-2025-46285
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
An integer overflow was addressed by adopting 64-bit timestamps. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. An app may be able to gain root privileges.
Analysis
Local privilege escalation to root on Apple platforms via integer overflow in timestamp handling allows authenticated users with low-level access to fully compromise system integrity and confidentiality. Affects iOS, iPadOS, macOS (Sequoia, Sonoma, Tahoe), tvOS, visionOS, and watchOS prior to February 2025 security updates. Vendor-released patches available across all platforms. EPSS probability is minimal (0.02%, 4th percentile), and no public exploit identified at time of analysis, though the local attack vector with low complexity and authenticated requirement reduces remote exploitation risk but creates insider threat exposure.
Technical Context
This vulnerability stems from an integer overflow (CWE-190) in Apple's operating system timestamp processing mechanisms. Integer overflows occur when arithmetic operations produce values exceeding the maximum representable value for a given data type, potentially causing memory corruption or logic errors. Apple's legacy use of 32-bit timestamps created overflow conditions that malicious applications could exploit to manipulate memory boundaries and escalate privileges. The fix migrates to 64-bit timestamp representations, extending the overflow horizon beyond practical exploitation timeframes. The vulnerability exists in low-level system time management code shared across Apple's unified operating system architecture (Darwin kernel components), affecting the entire product ecosystem from mobile devices to desktop and embedded platforms. CPE data identifies macOS as primary affected products, though vendor advisories confirm cross-platform impact including iOS 18.x/26.x, iPadOS, tvOS, visionOS, and watchOS variants.
Affected Products
Apple iOS versions prior to 18.7.3 and 26.2, iPadOS versions prior to 18.7.3 and 26.2, macOS Sequoia versions prior to 15.7.3, macOS Sonoma versions prior to 14.8.3, macOS Tahoe versions prior to 26.2, tvOS versions prior to 26.2, visionOS versions prior to 26.2, and watchOS versions prior to 26.2 are confirmed vulnerable per Apple security advisories HT214785 through HT214791. The CPE identifiers cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* indicate broad macOS version exposure across recent major releases. All Apple platforms sharing the Darwin kernel foundation and common timestamp handling libraries are impacted, spanning mobile, desktop, television, and wearable device categories manufactured and distributed globally.
Remediation
Install vendor-released security updates immediately through standard Apple software update mechanisms. For iOS and iPadOS devices, upgrade to version 18.7.3 or 26.2 depending on device compatibility. For macOS systems, apply Sequoia 15.7.3, Sonoma 14.8.3, or Tahoe 26.2 as appropriate for your macOS generation. Apple TV devices require tvOS 26.2, Vision Pro headsets require visionOS 26.2, and Apple Watch devices require watchOS 26.2. Detailed installation guidance and device-specific eligibility information available at Apple support advisories https://support.apple.com/en-us/125887 (macOS Sequoia), https://support.apple.com/en-us/125888 (macOS Sonoma), and related HT214785-HT214791 advisory pages for other platforms. No workarounds exist; patching is the only effective mitigation. For enterprise environments using Mobile Device Management, prioritize deployment to administrator workstations, developer systems, and any devices processing sensitive data or credentials. Verify successful patch application through system version reporting in Settings or About This Mac panels.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today