CVE-2025-46285CWE-190

CVE-2025-46285

High · published December 13, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

⚡ An integer overflow in Apple’s ecosystem could let an app acquire root privileges — a serious risk lurking in your pocket! Think of it like a restaurant that mistakenly lets a guest into the kitchen just because they ordered a fancy dish — no one should have that level of access without proper screening! If exploited, an attacker could gain full control of the device, allowing them to access sensitive data, take over accounts, or even install malicious software. This could lead to a complete compromise of personal privacy and security!

Put simply

Think of it like a restaurant that mistakenly lets a guest into the kitchen just because they ordered a fancy dish — no one should have that level of access without proper screening! This vulnerability stems from the handling of timestamps using integers, which could overflow and let untrusted apps escalate their privileges to root. By adopting 64-bit timestamps, this critical issue has now been addressed in recent updates.

What to do

If exploited, an attacker could gain full control of the device, allowing them to access sensitive data, take over accounts, or even install malicious software. This could lead to a complete compromise of personal privacy and security! Update your iOS or iPadOS devices to version 18.7.3 or 26.2, and ensure macOS devices are on Sequoia 15.7.3, Sonoma 14.8.3, or Tahoe 26.2. Similarly, keep tvOS, visionOS, and watchOS updated to version 26.2 as well. You've got this! Stay updated and secure, and you'll keep those pesky vulnerabilities at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.5th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2025-12-13T02:15Z
Affected products (2)
ProductVersionsFixed in
apple/macos< 14.8.314.8.3
apple/macos≥ 15.0, < 15.7.315.7.3
References (8)
EPSS history
Timeline
  • 12 DEC 20:56Z
    An integer overflow was addressed by adopting 64-bit timestamps
    cvelistv5