CVE-2025-43520KEV · OVERDUECWE-120

Apple Multiple Products Classic Buffer Overflow Vulnerability

Medium · published December 13, 2025

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.5. It is confirmed in active exploitation. It sits in the 35.7th percentile for exploit probability.

204
days past CISA
deadline
CVSS v3.1
5.5
EPSS
0%
Percentile
35.7
In the wild
Confirmed
What it is

⚠️ A crafty memory corruption issue could cause your device to crash unexpectedly! This vulnerability can be triggered by a malicious application, leading to potential chaos on your system! 😱 Think of this like a restaurant where a sneaky cook decides to change the recipe without telling anyone—suddenly, everything starts tasting off and might even lead to a disastrous kitchen fire! An attacker could exploit this vulnerability to crash your device or, worse, tamper with sensitive kernel memory—imagine a server suddenly shutting down without warning, causing a serious disruption in your work or personal life!

Put simply

Think of this like a restaurant where a sneaky cook decides to change the recipe without telling anyone—suddenly, everything starts tasting off and might even lead to a disastrous kitchen fire! This memory corruption issue arises from improper memory handling, allowing an attacker to force a system termination or manipulate kernel memory through a malicious app.

What to do

An attacker could exploit this vulnerability to crash your device or, worse, tamper with sensitive kernel memory—imagine a server suddenly shutting down without warning, causing a serious disruption in your work or personal life! To protect yourself, update your devices to the latest versions: iOS 18.7.2, iPadOS 18.7.2, macOS Sequoia 15.7.2, and others. Regularly check for software updates and ensure your security settings are tight! You're on your way to securing your devices! Follow these steps, and you'll have this vulnerability under control in no time. 🛡️

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-12-13T02:15Z
KEV added
2026-03-20 · due 2026-04-03
Affected products (10)
ProductVersionsFixed in
apple/ipados< 18.7.218.7.2
apple/ipadosall versions—
apple/iphone_os< 18.7.218.7.2
apple/iphone_osall versions—
apple/macos≥ 14.0, < 14.8.214.8.2
apple/macos≥ 15.0, < 15.7.215.7.2
apple/macosall versions—
apple/tvos< 26.126.1
apple/visionos< 26.126.1
apple/watchos< 26.126.1
References (10)
EPSS history
Timeline
  • 20 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 3
    kev
  • 12 DEC 20:56Z
    A memory corruption issue was addressed with improved memory handling
    cvelistv5