CVE-2025-43386CWE-125

CVE-2025-43386

High · published November 4, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
12.4
In the wild
Unconfirmed
What it is

⚡ A crafty media file could send your app crashing unexpectedly! This out-of-bounds access issue could cause chaos and corruption just waiting for a malicious touch! 🔥 Think of it like a delivery driver who accidentally drives off with someone else's package — the app is left confused and unable to figure out where it went wrong, possibly leaving sensitive information behind. If exploited, an attacker could force an app to terminate unexpectedly, leading to data corruption or loss. This means user data might be exposed or even worse, your app could become unresponsive when users need it the most!

Put simply

Think of it like a delivery driver who accidentally drives off with someone else's package — the app is left confused and unable to figure out where it went wrong, possibly leaving sensitive information behind. This vulnerability arises from insufficient bounds checking when processing media files, allowing an attacker to manipulate memory address access and lead to unexpected behavior in the app.

What to do

If exploited, an attacker could force an app to terminate unexpectedly, leading to data corruption or loss. This means user data might be exposed or even worse, your app could become unresponsive when users need it the most! To protect your systems, update to the latest versions: iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, and tvOS 26.1. Regularly monitor for updates and ensure your users are running the safest versions! You’ve got this! Keep those systems secure and get those updates rolled out! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-11-04T07:15Z
Affected products (4)
ProductVersionsFixed in
apple/ipados< 26.126.1
apple/iphone_os< 26.126.1
apple/tvos< 26.126.1
apple/visionos< 26.126.1
References (5)
EPSS history
Timeline
  • 04 NOV 01:17Z
    An out-of-bounds access issue was addressed with improved bounds checking
    cvelistv5