CVE-2025-43347CWE-20

CVE-2025-43347

Critical · published September 16, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

🔥 A critical input validation flaw is lurking in iOS and macOS systems, potentially opening the door for attackers! Think of it like a restaurant that doesn’t check the ingredients of the dishes it serves — one bad order could lead to some real chaos in the kitchen. Without proper oversight, malicious input can slip through and wreak havoc. An attacker could exploit this vulnerability to manipulate system behavior, potentially leading to data leaks or unauthorized access. This could be absolutely devastating for users relying on these devices for personal and sensitive information!

Put simply

Think of it like a restaurant that doesn’t check the ingredients of the dishes it serves — one bad order could lead to some real chaos in the kitchen. Without proper oversight, malicious input can slip through and wreak havoc. This vulnerability stems from an insufficient input validation mechanism, which allows attackers to send crafted input that the system does not properly validate, leading to unpredictable behavior.

What to do

An attacker could exploit this vulnerability to manipulate system behavior, potentially leading to data leaks or unauthorized access. This could be absolutely devastating for users relying on these devices for personal and sensitive information! Update your iOS or macOS devices to version 26 immediately to patch this vulnerability. It's crucial to ensure all affected devices, including iPads, Macs, and Apple Watches, are upgraded to maintain security. You've got this! Stay proactive, update your devices, and keep your digital world safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00892 · 59.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-09-16T03:15Z
Affected products (6)
ProductVersionsFixed in
apple/ipados< 26.026.0
apple/iphone_os< 26.026.0
apple/macos< 26.026.0
apple/tvos< 26.026.0
apple/visionos< 26.026.0
apple/watchos< 26.026.0
References (10)
EPSS history
Timeline
  • 15 SEP 22:34Z
    This issue was addressed by removing the vulnerable code
    cvelistv5