CVE-2025-43533

Malicious HID Device Triggers Process Crash via Bounds Checking Error on Apple Operating Systems

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 5 more

CVE-2025-43448

Symlink validation flaw could enable sandbox escape in Apple operating systems

This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to break out of its sandbox.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 6 more

CVE-2025-43429

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 4.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 4 more

CVE-2025-43444

Permissions Issue Allows User Fingerprinting

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to fingerprint the user.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipad Os Ipados and 4 more

CVE-2025-43445

Media File Out‑of‑Bounds Read Leading to App Crash or Memory Corruption

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 6 more

CVE-2025-43500

Sensitive Data Exposure via Improper Handling of User Preferences

A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to access sensitive user data.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 2 more

CVE-2025-43423

Logging Redaction Bypass on Unlocked Devices with Physical Access

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1. An attacker with physical access to an unlocked device paired with a Mac may be able to view sensitive user information in system logging.

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipad Os Ipados and 3 more

CVE-2025-43458

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 4 more

CVE-2025-43434

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 3 more

CVE-2025-43443

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 4 more

CVE-2025-43480

webkitgtk: A malicious website may exfiltrate data cross-origin

The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 4 more

CVE-2025-43440

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 4 more

CVE-2025-43436

Permissions Bypass Allows Enumeration of Installed Apps

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to enumerate a user's installed apps.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipad Os Ipados and 5 more

CVE-2025-43431

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 4 more

CVE-2025-43493

Address Bar Spoofing Vulnerability in Safari and Apple Platform Browsers

The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Visiting a malicious website may lead to address bar spoofing.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 2 more

CVE-2025-43502

Privacy Preference Bypass Vulnerability in Safari and Apple Operating Systems

A privacy issue was addressed by removing sensitive data. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. An app may be able to bypass certain Privacy preferences.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 2 more

CVE-2025-43430

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 4 more

CVE-2025-43510

Memory Corruption Leading to Remote Code Execution Through Improper Locking

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Listed

Vendors

Apple

Products

Ios Ipad Os Ipados and 8 more

CVE-2025-43428

Hidden Photos Visible Without Authentication

A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Photos in the Hidden Photos Album may be viewed without authentication.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 3 more

CVE-2025-43531

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os and 6 more