CVE-2025-43494CWE-20

CVE-2025-43494

High · published December 13, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

⚡ A mail header parsing flaw could lead to a persistent denial-of-service — imagine your inbox getting jammed with non-stop spam! 📧 Think of this vulnerability like a poorly designed postal system that can't handle certain types of mail; it gets overwhelmed and stops delivering any mail at all. Just like that system, our devices could freeze up and become unusable if they encounter the wrong header. If exploited, an attacker could effectively shut down email functionality, making it impossible to send or receive messages — a frustrating situation that could disrupt both personal communications and business operations. This could lead to significant downtime and hinder productivity.

Put simply

Think of this vulnerability like a poorly designed postal system that can't handle certain types of mail; it gets overwhelmed and stops delivering any mail at all. Just like that system, our devices could freeze up and become unusable if they encounter the wrong header. The vulnerability lies in the way mail headers are parsed, lacking proper checks that could allow an attacker to exploit this flaw, resulting in a denial-of-service condition.

What to do

If exploited, an attacker could effectively shut down email functionality, making it impossible to send or receive messages — a frustrating situation that could disrupt both personal communications and business operations. This could lead to significant downtime and hinder productivity. To protect against this issue, update your devices immediately to the fixed versions: iOS 18.7.2, iPadOS 18.7.2, macOS Sequoia 15.7.2, and others listed in the CVE description. It's crucial to stay current with updates to avoid potential disruptions. You've got this! Updating your devices will keep your mail system running smoothly and securely. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00573 · 46.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-12-13T02:15Z
Affected products (9)
ProductVersionsFixed in
apple/ipados< 18.7.218.7.2
apple/ipadosall versions—
apple/iphone_os< 18.7.218.7.2
apple/iphone_osall versions—
apple/macos≥ 14.0, < 14.8.214.8.2
apple/macos≥ 15.0, < 15.7.215.7.2
apple/macosall versions—
apple/visionos< 26.126.1
apple/watchos< 26.126.1
References (7)
EPSS history
Timeline
  • 12 DEC 20:56Z
    A mail header parsing issue was addressed with improved checks
    cvelistv5