CVE-2025-43338CWE-79cross-site-scripting

CVE-2025-43338

High · published November 4, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

⚡ A crafty media file could bring your app to its knees! This out-of-bounds access issue in Apple software could lead to app crashes or memory corruption. 🔥 Think of it like a delivery truck trying to unload packages into a storage room that's too small — if the truck doesn't check the size, it ends up causing chaos, spilling packages everywhere! An attacker could exploit this flaw by sending a specially crafted media file, resulting in unexpected app terminations. This not only disrupts the user experience but also risks corrupting the memory, potentially exposing sensitive data. It's like a party crasher who not only shows up uninvited but also spills drinks everywhere!

Put simply

Think of it like a delivery truck trying to unload packages into a storage room that's too small — if the truck doesn't check the size, it ends up causing chaos, spilling packages everywhere! This out-of-bounds access vulnerability in iOS, iPadOS, and macOS can lead to app crashes or memory corruption due to improper bounds checking when handling media files. The flaw allows attackers to manipulate memory access beyond the intended limits.

What to do

An attacker could exploit this flaw by sending a specially crafted media file, resulting in unexpected app terminations. This not only disrupts the user experience but also risks corrupting the memory, potentially exposing sensitive data. It's like a party crasher who not only shows up uninvited but also spills drinks everywhere! Update your devices to iOS 26, iPadOS 26, or macOS Sonoma 14.8.4 to close this vulnerability. Regularly audit applications for safe media handling practices to further protect against potential exploits. Don't delay — secure your systems now! You can conquer this! Update your devices and keep your systems safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-04T07:15Z
Affected products (3)
ProductVersionsFixed in
apple/ipados< 26.026.0
apple/iphone_os< 26.026.0
apple/macos< 14.8.214.8.2
References (4)
EPSS history
Timeline
  • 04 NOV 01:17Z
    An out-of-bounds access issue was addressed with improved bounds checking
    cvelistv5