CVE-2025-43520: Apple Multiple Products classic buffer overflow in kernel memory

CVE-2025-43520 · Severity: critical · CVSS 5.5 · Exploited in the wild · Published 2025-12-12

A security vulnerability exists in Apple's operating systems, including those for iPhone, Mac, and Apple Watch, which could allow a malicious app to crash the system or modify sensitive kernel memory. This flaw is being actively exploited in the wild, potentially allowing attackers to compromise the core security of the device. Users should update their devices to the latest software versions immediately to protect their data and system stability.

Technologies: Apple iPadOS, Apple macOS Sequoia, Apple Multiple Products, Apple Tvos, Apple Visionos, Apple watchOS. Vendors: Apple.

Quick answers

Is CVE-2025-43520 exploited in the wild?
Yes. CVE-2025-43520 is known to be exploited in the wild, first recorded on 20 March 2026. Treat it as urgent.
How severe is CVE-2025-43520?
Critical severity, with a CVSS score of 5.5, published 12 December 2025.
Which products and versions are affected?
Apple iPadOS Before 18.7.2, 26.0 to 26.1; Apple macOS Sequoia Before 15.7.2; Apple macOS Sonoma Before 14.8.2; Apple Tvos Before 26.1; and 2 more.
Is there a fix for CVE-2025-43520?
A patch was published on 2026-03-20: Fixes released in various OS updates including iOS 18.7.2 and macOS 15.7.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-43520 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-43520?
Check whether you run Apple iPadOS, Apple macOS Sequoia, Apple macOS Sonoma or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in the kernel or a high-privilege component of multiple Apple operating systems due to improper memory handling. A local attacker can exploit this by running a malicious application on the target device to cause a denial-of-service (system crash) or perform unauthorized writes to kernel memory. This vulnerability is part of a known exploit chain and has been observed in active attacks. Apple addressed the issue by improving memory handling across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

Affected products

  • Apple iOS Before 18.7.2, 26.0 to 26.1
  • Apple iPadOS Before 18.7.2, 26.0 to 26.1
  • Apple macOS Sequoia Before 15.7.2
  • Apple macOS Sonoma Before 14.8.2
  • Apple macOS Tahoe Before 26.1
  • Apple tvOS Before 26.1
  • Apple visionOS Before 26.1
  • Apple watchOS Before 26.1

Timeline

  • 2026-03-20: disclosed
  • 2026-03-20: kev added: Added to CISA KEV catalog due to active exploitation.
  • 2026-03-20: patched: Fixes released in various OS updates including iOS 18.7.2 and macOS 15.7.2.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.