CVEs / CVE-2025-43520
CVE-2025-43520: Apple Multiple Products Classic Buffer Overflow Vulnerability
- Known exploited in the CISA KEV catalog since 20 Mar 2026
- medium 5.5 CVSS 3.1 (NVD)
- EPSS 0.42% chance of exploitation in the next 30 days, higher than 36% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2025-43520
Summary
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
Description
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS and iPadOS | before 18.7.2 | 18.7.2 |
| Apple iOS and iPadOS | before 26.1 | 26.1 |
| Apple macOS | before 14.8.2 | 14.8.2 |
| Apple macOS | before 15.7.2 | 15.7.2 |
| Apple macOS | before 26.1 | 26.1 |
| Apple tvOS | before 26.1 | 26.1 |
| Apple visionOS | before 26.1 | 26.1 |
| Apple watchOS | before 26.1 | 26.1 |
Exploitation
| In CISA KEV since | 20 Mar 2026 |
|---|---|
| Due date for US federal agencies | 3 Apr 2026 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 5.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HScored by NVD |
|---|---|
| Weakness | CWE-120 |
References
- CVE-2025-43520 on NVD
- CVE-2025-43520 in the CISA KEV catalog
- https://support.apple.com/en-us/125632 (cited by CISA)
- https://support.apple.com/en-us/125633 (cited by CISA)
- https://support.apple.com/en-us/125634 (cited by CISA)
- https://support.apple.com/en-us/125635 (cited by CISA)
- https://support.apple.com/en-us/125636 (cited by CISA)
- https://support.apple.com/en-us/125637 (cited by CISA)
- https://support.apple.com/en-us/125638 (cited by CISA)
- https://support.apple.com/en-us/125639 (cited by CISA)
- https://support.apple.com/en-us/125632 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/125633 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/125634 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/125635 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/125636 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/125637 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/125638 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/125639 Release Notes, Vendor Advisory
- https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/ Technical Description
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43520 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.