CVE-2025-43205

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43205", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-04-16T15:24:37.088Z", "datePublished": "2025-11-12T00:20:52.053Z", "dateUpdated": "2026-04-02T18:12:47.787Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "An app may be able to bypass ASLR"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "17.7.6", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "13.7.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "14.7.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "15.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "tvOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "0", "status": "affected", "lessThan": "2.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"version": "0", "status": "affected", "lessThan": "11.4", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to bypass ASLR."}], "references": [{"url": "https://support.apple.com/en-us/122371"}, {"url": "https://support.apple.com/en-us/122372"}, {"url": "https://support.apple.com/en-us/122373"}, {"url": "https://support.apple.com/en-us/122374"}, {"url": "https://support.apple.com/en-us/122375"}, {"url": "https://support.apple.com/en-us/122376"}, {"url": "https://support.apple.com/en-us/122377"}, {"url": "https://support.apple.com/en-us/122378"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:12:47.787Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T21:23:30.967388Z", "id": "CVE-2025-43205", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T20:50:10.643Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-43205", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T21:23:30.967388Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T21:24:00.204Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "watchOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "11.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "tvOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.4", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/122376"}, {"url": "https://support.apple.com/en-us/122377"}, {"url": "https://support.apple.com/en-us/122371"}, {"url": "https://support.apple.com/en-us/122378"}], "descriptions": [{"lang": "en", "value": "An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in watchOS 11.4, tvOS 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4. An app may be able to bypass ASLR."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "An app may be able to bypass ASLR"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-11-12T00:20:52.053Z"}}}, "cveMetadata": {"cveId": "CVE-2025-43205", "state": "PUBLISHED", "dateUpdated": "2025-11-13T20:50:10.643Z", "dateReserved": "2025-04-16T15:24:37.088Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-11-12T00:20:52.053Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "iOS and iPadOS", "vendor": "Apple", "versions": [{"lessThan": "18.4", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "iPadOS", "vendor": "Apple", "versions": [{"lessThan": "17.7.6", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "13.7.5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "14.7.5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "15.4", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "tvOS", "vendor": "Apple", "versions": [{"lessThan": "18.4", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "visionOS", "vendor": "Apple", "versions": [{"lessThan": "2.4", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "watchOS", "vendor": "Apple", "versions": [{"lessThan": "11.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B3450F7-7B4A-46CE-A6E0-BBE6569F2EBF", "versionEndExcluding": "18.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D9C73F9-FEF4-4FC1-B83D-56566AD35990", "versionEndExcluding": "18.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C61CCC2-87D3-4A3A-837B-63C48299A7AD", "versionEndExcluding": "18.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "matchCriteriaId": "E82603D7-A630-4B9B-9C51-880667F05EC7", "versionEndExcluding": "2.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "matchCriteriaId": "1B93684A-A17F-487C-8C19-E6E30C1C4790", "versionEndExcluding": "11.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to bypass ASLR."}, {"lang": "es", "value": "Se abord\u00f3 un problema de acceso fuera de l\u00edmites con una comprobaci\u00f3n de l\u00edmites mejorada. Este problema se corrigi\u00f3 en watchOS 11.4, tvOS 18.4, visionOS 2.4, iOS 18.4 y iPadOS 18.4. Una aplicaci\u00f3n podr\u00eda eludir ASLR."}], "id": "CVE-2025-43205", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43205", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T21:23:30.967388Z", "version": "2.0.3"}}]}, "published": "2025-11-12T01:15:34.950", "references": [{"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122371"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/122372"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/122373"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/122374"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/122375"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122376"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122377"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122378"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T22:52:26.626323+00:00", "value": {"mitigation_remediation": ["Install the latest OS releases that include the bounds\u2011checking fix: iOS 18.4+, iPadOS 18.4/17.7.6+, macOS Sequoia\u202f15.4, macOS Sonoma\u202f14.7.5, macOS Ventura\u202f13.7.5, tvOS\u202f18.4, visionOS\u202f2.4, watchOS\u202f11.4 or later. ", "If a device cannot be updated to a fixed release, remove or block execution of applications that could trigger the out\u2011of\u2011bounds read to reduce the chance of an ASLR bypass. ", "Configure device management to enforce automatic OS updates and block installation of apps from unverified sources, limiting the opportunity for malicious exploitation."], "summary": {"action": "Update OS", "impact": "Out-of-Bounds Memory Access with ASLR Bypass"}, "threat_synthesis": {"affected_systems": "Apple devices running iOS 18.4 or later, iPadOS 18.4 or 17.7.6 and later, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, and watchOS 11.4 and later are affected. Products are affected in the indicated firmware releases.", "description_and_impact": "This vulnerability allows a program to read memory beyond its allocated bounds. The flaw is mitigated by improved bounds checking, yet an attacker can still bypass address\u2011space layout randomization, potentially making further attacks easier. The impact is limited to memory disclosure and compromise of address randomization, which increases the difficulty of unrelated exploits but does not directly enable unrestricted code execution.", "risk_and_exploitability": "The CVSS score of 4.0 indicates moderate severity, while an EPSS score of less than 1% shows that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve a malicious application installed on the device; the attacker would need the app to trigger the bounds check failure to bypass ASLR."}}}}, "created": "2025-11-12T12:36:26.854174+00:00", "title": "Out-of-Bounds Access Enabling ASLR Bypass", "updated": "2026-04-27T23:00:13.981848+00:00", "vendors": ["apple", "apple$PRODUCT$ios", "apple$PRODUCT$ipados", "apple$PRODUCT$tvos", "apple$PRODUCT$visionos", "apple$PRODUCT$watchos"]}