Apple · Multiple Products
CVE-2025-43520
Apple Multiple Products Classic Buffer Overflow Vulnerability
What it is
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.
CISA: Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: April 3, 2026
- Added to the CISA list
- March 20, 2026
- Published
- December 12, 2025
- Severity
- Medium 5.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 0.4% in the top 63.4% of all known vulnerabilities
- Weakness
- CWE-120
- More details
- NVD · CVE.org · CISA
All references (8)
- https://support.apple.com/en-us/125632
- https://support.apple.com/en-us/125633
- https://support.apple.com/en-us/125634
- https://support.apple.com/en-us/125635
- https://support.apple.com/en-us/125636
- https://support.apple.com/en-us/125637
- https://support.apple.com/en-us/125638
- https://support.apple.com/en-us/125639
More exploited flaws from Apple
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 29, 2026 | Out-of-Bounds Write | Multiple Products | High 8.8 | 26% |
| Mar 20, 2026 | Buffer Overflow | Multiple Products | High 8.8 | 1.7% |
| Mar 20, 2026 | Improper Locking | Multiple Products | High 7.8 | 0.4% |
| Mar 5, 2026 | Integer Overflow or Wraparound | Multiple Products | High 8.8 | 7.0% |
| Mar 5, 2026 | Use-After-Free | Multiple Products | High 8.8 | 4.0% |
| Feb 12, 2026 | Multiple Buffer Overflow | Multiple Products | High 7.8 | 1.7% |
| Dec 15, 2025 | Use-After-Free WebKit | Multiple Products | High 8.8 | 26% |
| Oct 20, 2025 | Unspecified | Multiple Products | High 8.8 | 3.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.