CVE-2025-43510
Apple Multiple Products Improper Locking Vulnerability
Description
CVE-2025-43510 is a HIGH improper locking vulnerability affecting multiple Apple products including watchOS, iOS, iPadOS, macOS, visionOS, and tvOS, carrying a CVSS 3.1 score of 7.8. A memory corruption issue caused by improper lock state checking allows a malicious application to cause unexpected changes in memory shared between processes. Affected versions include iPadOS < 18.7.2 and 26.0, iOS < 18.7.2 and 26.0, macOS 14.x < 14.8.2, macOS 15.x < 15.7.2, macOS 26.0, tvOS < 26.1, visionOS < 26.1, and watchOS < 26.1. This CVE was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-03-20 with a remediation deadline of 2026-04-03. With an EPSS score of 0.00462 (64.1st percentile), this vulnerability demonstrates notable exploitation probability and should be prioritized for immediate patching. No ransomware association has been confirmed.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 18.7.2; 26.0 |
| apple | iphone os | < 18.7.2; 26.0 |
| apple | macos | >= 14.0, < 14.8.2; >= 15.0, < 15.7.2; 26.0 |
| apple | tvos | < 26.1 |
| apple | visionos | < 26.1 |
| apple | watchos | < 26.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/125632(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125633(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125634(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125635(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125636(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125637(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125638(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125639(Release Notes, Vendor Advisory)
- https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/(Technical Description)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43510(US Government Resource)
Weakness Type
CWE-667: Improper Locking
CVE-2025-43510 is classified under CWE-667 — Improper Locking. This weakness occurs when a product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes. Improper locking can manifest as race conditions, deadlocks, or memory corruption when multiple processes or threads access shared resources without adequate synchronization.
In the context of Apple's operating systems, this weakness is particularly dangerous because modern Apple platforms rely heavily on inter-process communication and shared memory regions. When lock state checking is insufficient, a malicious application running in user space can manipulate shared memory in ways that affect other processes, potentially escalating privileges or corrupting critical system state. The memory corruption resulting from this improper locking could allow an attacker to achieve arbitrary code execution or modify sensitive data structures used by the kernel or other privileged processes.
Impact Analysis
CVE-2025-43510 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation allows the attacker to read sensitive data from memory shared between processes. This could include authentication tokens, encryption keys, or other privileged data structures managed by the operating system kernel.
Integrity (HIGH): The core impact of this vulnerability lies in memory corruption — an attacker can cause unexpected changes to shared memory, potentially modifying critical system data, injecting malicious payloads, or altering the execution flow of privileged processes.
Availability (HIGH): Memory corruption from improper locking can lead to system instability, kernel panics, or complete device crashes. Repeated exploitation could render the affected device unusable until patched.
Scope Unchanged: The vulnerability's scope is Unchanged (S:U), meaning the impact is contained within the vulnerable component. However, given the kernel-level nature of shared memory management, the practical impact can extend across the entire device.
The EPSS score of 0.00462 (64.1st percentile) indicates moderate but real exploitation probability, supported by the KEV catalog listing confirming active exploitation.
Exploit Maturity
CVE-2025-43510 has confirmed active exploitation in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog on 2026-03-20.
Exploit status: Active exploitation has been confirmed. Apple acknowledged the vulnerability was exploited before patches were released, indicating this was used as a zero-day in targeted attacks. The KEV listing provides authoritative confirmation of real-world exploitation.
EPSS assessment: The EPSS score of 0.00462 (64.1st percentile) places this vulnerability above the median for exploitation likelihood. While not in the highest percentiles, the confirmed KEV listing demonstrates that statistical models may underestimate targeted exploitation of Apple zero-days.
Ransomware association: No direct ransomware association has been confirmed for CVE-2025-43510 as of the latest KEV data. The local attack vector (AV:L) and requirement for user interaction (UI:R) make mass ransomware deployment less likely, though targeted attacks remain a significant concern.
Attack surface: The vulnerability affects the full range of Apple operating systems — iOS, iPadOS, macOS, watchOS, tvOS, and visionOS — creating a broad attack surface across consumer and enterprise environments. Exploitation requires local access and user interaction, typically achieved through a malicious application.
KEV deadline: CISA requires federal agencies to remediate this vulnerability by 2026-04-03. All organizations should treat this deadline as a strong guideline for their own remediation timelines.
Remediation
- Apply Apple security updates immediately. Update all affected devices to the patched versions: iOS 18.7.2 / iOS 26.1, iPadOS 18.7.2 / iPadOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1, watchOS 26.1, tvOS 26.1, and visionOS 26.1. Consult Apple's official security advisory at support.apple.com/en-us/100100 for detailed guidance.
- Inventory all Apple devices in your environment. Use mobile device management (MDM) solutions and asset inventory tools to identify all instances of affected Apple operating systems across your organization. Pay special attention to unmanaged personal devices in BYOD environments.
- Implement interim mitigations if patching is delayed. Restrict the installation of untrusted applications via MDM policies. Enable app review and signing requirements. Monitor for unusual process behavior and unexpected memory access patterns on critical devices.
- Scan for indicators of prior exploitation. Given the confirmed active exploitation, review device logs and endpoint detection data for signs of compromise. Look for unusual application behavior, unexpected process crashes, or unauthorized data access that may indicate exploitation of this memory corruption vulnerability.
- Enforce automatic updates and review MDM policies. Configure managed devices to automatically install security updates. Review and tighten application installation policies to reduce the risk of users installing malicious applications that could exploit this vulnerability.
Technical Details
CVE-2025-43510 is a HIGH-severity memory corruption vulnerability in multiple Apple operating systems caused by improper lock state checking in shared memory management. The vulnerability allows a malicious application to cause unexpected changes in memory shared between processes.
Technical mechanism: The root cause is a failure in the lock state checking mechanism that governs access to memory regions shared between processes. When a process acquires a lock on shared memory, the system must verify the lock state before allowing modifications. The flawed implementation allowed a malicious application to bypass or circumvent these lock checks, enabling unauthorized writes to shared memory segments. This creates a classic race condition scenario where the attacker's process can modify memory that other processes expect to be protected.
CVSS 3.1 vector breakdown (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H):
- Attack Vector (Local): The attacker must execute a malicious application on the target device. This is typically achieved by convincing the user to install a malicious app or through an already-compromised application.
- Attack Complexity (Low): No specialized conditions or timing requirements are needed beyond running the malicious application. The lock state bypass is reliable and reproducible.
- Privileges Required (None): No special privileges are needed — a standard unprivileged application can trigger the vulnerability.
- User Interaction (Required): The user must take an action such as installing or launching the malicious application.
- Scope (Unchanged): The impact is technically contained within the vulnerable memory management component, though shared memory corruption can cascade across processes.
- Impact (C:H/I:H/A:H): Full compromise of confidentiality, integrity, and availability is possible through the shared memory corruption primitive.
Affected platforms: The vulnerability spans Apple's entire ecosystem — watchOS 26.1, iOS 18.7.2 and 26.1, iPadOS 18.7.2 and 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1, and tvOS 26.1 — indicating the flawed code resides in a core shared memory subsystem common to all Apple operating systems.
Frequently Asked Questions
What is CVE-2025-43510?
CVE-2025-43510 is a HIGH-severity memory corruption vulnerability (CVSS 7.8) affecting multiple Apple operating systems including iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. The vulnerability stems from improper lock state checking in shared memory management, allowing a malicious application to corrupt memory shared between processes. It is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active real-world exploitation.
Which Apple products are affected by CVE-2025-43510?
Affected products include iPadOS < 18.7.2 and 26.0, iOS < 18.7.2 and 26.0, macOS Sonoma 14.x < 14.8.2, macOS Sequoia 15.x < 15.7.2, macOS Tahoe 26.0, tvOS < 26.1, visionOS < 26.1, and watchOS < 26.1. The broad scope across Apple's ecosystem indicates the vulnerability exists in a core shared component. Organizations should audit all Apple devices in their environment.
How do I fix CVE-2025-43510?
Update all affected Apple devices to the latest patched versions: iOS 18.7.2 or 26.1, iPadOS 18.7.2 or 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, or macOS Tahoe 26.1, watchOS 26.1, tvOS 26.1, and visionOS 26.1. Use MDM solutions to enforce updates across managed devices. If immediate patching is not possible, restrict untrusted application installation and monitor for suspicious process behavior.
Is CVE-2025-43510 associated with ransomware?
No direct ransomware association has been confirmed for CVE-2025-43510. The local attack vector requiring user interaction makes mass ransomware deployment less likely. However, the vulnerability has been actively exploited in the wild, and organizations should treat it with high urgency regardless of the ransomware status. The CISA KEV remediation deadline is 2026-04-03.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.