CVE-2025-43520
Apple Multiple Products Classic Buffer Overflow Vulnerability
Description
CVE-2025-43520 is a HIGH buffer overflow vulnerability affecting multiple Apple products including watchOS, iOS, iPadOS, macOS, visionOS, and tvOS, carrying a CVSS 3.1 score of 7.1. A memory corruption issue caused by improper memory handling allows a malicious application to cause unexpected system termination or write kernel memory. Affected versions include iPadOS < 18.7.2 and 26.0, iOS < 18.7.2 and 26.0, macOS 14.x < 14.8.2, macOS 15.x < 15.7.2, macOS 26.0, tvOS < 26.1, visionOS < 26.1, and watchOS < 26.1. This CVE was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-03-20 with a remediation deadline of 2026-04-03. With an EPSS score of 0.00475 (64.7th percentile), this vulnerability demonstrates real-world exploitation activity. No ransomware association has been confirmed.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 18.7.2; 26.0 |
| apple | iphone os | < 18.7.2; 26.0 |
| apple | macos | >= 14.0, < 14.8.2; >= 15.0, < 15.7.2; 26.0 |
| apple | tvos | < 26.1 |
| apple | visionos | < 26.1 |
| apple | watchos | < 26.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://support.apple.com/en-us/125632(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125633(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125634(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125635(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125636(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125637(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125638(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/125639(Release Notes, Vendor Advisory)
- https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/(Technical Description)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43520(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write & CWE-120: Classic Buffer Overflow
CVE-2025-43520 is classified under two related weaknesses:
CWE-787 — Out-of-bounds Write: This weakness occurs when a product writes data past the end, or before the beginning, of the intended buffer. Out-of-bounds writes can corrupt adjacent memory, crash the application, or enable arbitrary code execution. This is one of the most dangerous vulnerability classes, consistently ranking in the CWE Top 25 Most Dangerous Software Weaknesses.
CWE-120 — Classic Buffer Overflow: This weakness involves copying input data into a buffer without first verifying that the data fits within the buffer's boundaries. The classic buffer overflow has been a foundational vulnerability class since the earliest days of computer security and remains a critical threat in systems-level software.
In the context of Apple's operating systems, both weaknesses converge in the kernel memory handling code. The improper memory handling allows a malicious application to overflow a buffer in kernel space, leading to either a system crash (denial of service) or kernel memory writes that could enable privilege escalation and arbitrary code execution at the highest privilege level.
Impact Analysis
CVE-2025-43520 carries a CVSS 3.1 score of 7.1 (HIGH) with Unchanged Scope.
Confidentiality (NONE): The CVSS vector indicates no direct confidentiality impact. The vulnerability primarily enables writing to kernel memory rather than reading from it, meaning data exfiltration is not the primary attack vector.
Integrity (HIGH): The ability to write kernel memory represents a severe integrity impact. An attacker can modify critical kernel data structures, inject malicious code into privileged memory regions, or alter system behavior. Kernel memory writes can be leveraged to disable security mechanisms, modify access controls, or install persistent backdoors.
Availability (HIGH): The vulnerability can cause unexpected system termination — a kernel panic that crashes the entire device. This represents a complete denial of service that can only be resolved by rebooting the affected device. Repeated exploitation could be used to render devices persistently unusable.
Scope Unchanged: The scope is Unchanged (S:U), meaning the vulnerable and impacted components are the same. However, kernel memory writes effectively impact all processes and security boundaries on the device.
The combination of no confidentiality impact with high integrity and availability impact reflects a vulnerability primarily useful for system disruption and privilege escalation rather than data theft.
Exploit Maturity
CVE-2025-43520 has confirmed active exploitation in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog on 2026-03-20.
Exploit status: Active exploitation has been confirmed. Apple acknowledged the vulnerability was exploited prior to patch availability, classifying it as a zero-day. The vulnerability's ability to write kernel memory makes it a high-value target for sophisticated threat actors.
EPSS assessment: The EPSS score of 0.00475 (64.7th percentile) indicates above-median exploitation probability. Combined with the confirmed KEV listing, this vulnerability should be treated as actively exploited regardless of the statistical score.
Ransomware association: No direct ransomware association has been confirmed for CVE-2025-43520. The local attack vector (AV:L) and requirement for low-level privileges (PR:L) make automated ransomware deployment less practical. However, the kernel memory write capability could be chained with other vulnerabilities in a multi-stage attack.
Attack surface: The vulnerability spans Apple's entire product line — iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. The requirement for low privileges means any installed application could potentially exploit this vulnerability without additional privilege escalation.
KEV deadline: CISA requires federal agencies to remediate this vulnerability by 2026-04-03. All organizations should prioritize remediation accordingly.
Remediation
- Apply Apple security updates immediately. Update all affected devices to the patched versions: iOS 18.7.2 / iOS 26.1, iPadOS 18.7.2 / iPadOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1, watchOS 26.1, tvOS 26.1, and visionOS 26.1. Consult Apple's official security advisory at support.apple.com/en-us/100100 for detailed patch guidance.
- Identify all affected Apple devices in your environment. Use MDM solutions and vulnerability scanning tools to enumerate all instances of affected Apple operating systems. Include both managed corporate devices and unmanaged BYOD devices that access corporate resources.
- Implement application restrictions as interim mitigation. If immediate patching is not feasible, restrict application installation to trusted sources only via MDM policies. Tighten application sandboxing rules and monitor for unusual kernel-level activity or unexpected system crashes that may indicate exploitation attempts.
- Investigate for indicators of compromise. Given confirmed active exploitation, review crash logs and endpoint detection data for evidence of kernel panics caused by exploitation. Look for unexpected system reboots, unusual application behavior, or signs of privilege escalation that may indicate this vulnerability has been exploited.
- Harden device security posture. Enable advanced security features such as Lockdown Mode on critical devices. Ensure endpoint detection and response (EDR) solutions are deployed and configured to detect kernel-level exploitation attempts.
Technical Details
CVE-2025-43520 is a HIGH-severity buffer overflow vulnerability in multiple Apple operating systems caused by improper memory handling, enabling a malicious application to cause unexpected system termination or write kernel memory.
Technical mechanism: The vulnerability exists in the kernel's memory handling routines. A classic buffer overflow occurs when data written to a kernel buffer exceeds the allocated boundaries, corrupting adjacent memory regions. The improper memory handling fails to validate buffer sizes before write operations, allowing an attacker-controlled application to overflow a buffer and write arbitrary data to kernel memory addresses. This can corrupt kernel data structures, overwrite function pointers, or modify page tables.
CVSS 3.1 vector breakdown (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H):
- Attack Vector (Local): Exploitation requires the attacker to execute a malicious application on the target device. Remote exploitation is not possible without first achieving local code execution.
- Attack Complexity (Low): The buffer overflow is reliably triggerable without special conditions. No race conditions, specific configurations, or timing requirements are needed.
- Privileges Required (Low): Standard user-level privileges are sufficient to trigger the vulnerability. Any installed application running with normal permissions can exploit the flaw.
- User Interaction (None): No user interaction is required once the malicious application is running. The exploit can be triggered automatically, enabling persistent exploitation.
- Scope (Unchanged): The impact is contained within the vulnerable kernel component, though kernel memory writes effectively compromise the entire system.
- Impact (C:N/I:H/A:H): No confidentiality impact, but full integrity compromise through kernel memory writes and full availability impact through system termination.
Kernel memory write implications: The ability to write kernel memory is a powerful exploitation primitive. Attackers can use this to disable security features like System Integrity Protection (SIP), modify kernel extensions, alter process credentials for privilege escalation, or create persistent backdoors that survive application-level security controls.
Frequently Asked Questions
What is CVE-2025-43520?
CVE-2025-43520 is a HIGH-severity buffer overflow vulnerability (CVSS 7.1) affecting multiple Apple operating systems including iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. The vulnerability allows a malicious application to write kernel memory or cause system termination through improper memory handling. It is listed in CISA's KEV catalog, confirming active exploitation in the wild.
Which Apple products are affected by CVE-2025-43520?
Affected products include iPadOS < 18.7.2 and 26.0, iOS < 18.7.2 and 26.0, macOS Sonoma 14.x < 14.8.2, macOS Sequoia 15.x < 15.7.2, macOS Tahoe 26.0, tvOS < 26.1, visionOS < 26.1, and watchOS < 26.1. The vulnerability affects Apple's complete product ecosystem, indicating the flaw exists in a core kernel component shared across all platforms.
How do I fix CVE-2025-43520?
Update all affected Apple devices to the latest patched versions: iOS 18.7.2 or 26.1, iPadOS 18.7.2 or 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, or macOS Tahoe 26.1, watchOS 26.1, tvOS 26.1, and visionOS 26.1. Use MDM solutions to enforce updates across your device fleet. If patching is delayed, restrict application installation to trusted sources and enable Lockdown Mode on critical devices.
What makes CVE-2025-43520 dangerous despite having no confidentiality impact?
While the CVSS vector shows no direct confidentiality impact (C:N), the ability to write kernel memory is an extremely powerful exploitation primitive. An attacker can use kernel writes to disable security protections, escalate privileges, modify access controls, or install persistent backdoors. The high integrity and availability impact (I:H/A:H) means attackers can fully compromise system integrity and cause complete denial of service through kernel panics.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.