CVE-2025-30466

Same Origin Policy Bypass via State Management Flaw

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. A website may be able to bypass Same Origin Policy.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-43274

Sandbox Escalation via Unprotected Sensitive Data in macOS

A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to circumvent sandbox restrictions.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia

CVE-2025-43192

Account‑driven User Enrollment possible with Lockdown Mode on macOS

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. Account-driven User Enrollment may still be possible with Lockdown Mode turned on.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Sequoia Sonoma

CVE-2025-31279

Permissions‑Based User Fingerprinting Vulnerability in Apple iPadOS and macOS

A permissions issue was addressed with additional restrictions. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to fingerprint the user.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed

Vendors

Apple

Products

Ipados Macos Macos Sequoia and 2 more

CVE-2025-43215

Image Processing Memory Disclosure in macOS

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may result in disclosure of process memory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia

CVE-2025-31280

Memory Corruption Vulnerability in macOS via Malicious File

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted file may lead to heap corruption.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Sequoia

CVE-2025-31243

Permissions flaw enabling root privilege escalation in macOS

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43244

Race Condition in macOS Causes Unexpected System Termination

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause unexpected system termination.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43209

Out‑of‑Bounds Access in Safari Rendering Engine Leading to Crash

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 7 more

CVE-2025-43249

Root Privilege Escalation via Improper Logic Checks in Apple macOS

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43195

Environment Variable Validation Flaw Allows Sensitive Data Exposure

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43226

Out‑of‑Bounds Image Read Leading to Memory Disclosure

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted image may result in disclosure of process memory.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 6 more

CVE-2025-43230

Imprecise Access Control Allows Sensitive Data Disclosure on Apple Operating Systems

The issue was addressed with additional permissions checks. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. An app may be able to access user-sensitive data.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 5 more

CVE-2025-43260

Privileged App Entitlement Hijacking in macOS

This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to hijack entitlements granted to other privileged apps.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma

CVE-2025-43218

Out‑of‑Bounds Read in macOS from Malicious USD Files

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted USD file may disclose memory contents.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia

CVE-2025-43206

Directory Path Parsing Vulnerability Allowing Access to Protected User Data

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43255

Out‑of‑Bounds Read Leading to Unexpected System Termination in macOS

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause unexpected system termination.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43366

Coprocessor Memory Disclosure via Out‑of‑Bounds Read in macOS

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Tahoe 26. An app may be able to disclose coprocessor memory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-43326

Out-of-Bounds Read Causing Sensitive Data Exposure in macOS

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43367

Improper Disclosure of Protected User Data in macOS

A privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sonoma Macos Tahoe