CVE-2025-43365

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43365", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-04-16T15:24:37.113Z", "datePublished": "2025-11-04T01:17:59.138Z", "dateUpdated": "2026-04-02T18:26:51.978Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "An unprivileged process may be able to terminate a root processes"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.7.2", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "26", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26 and iPadOS 26. An unprivileged process may be able to terminate a root processes."}], "references": [{"url": "https://support.apple.com/en-us/125108"}, {"url": "https://support.apple.com/en-us/125633"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:26:51.978Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T12:55:21.597700Z", "id": "CVE-2025-43365", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T12:55:24.628Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-43365", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T12:55:21.597700Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T12:55:15.107Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.7", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/125633"}], "descriptions": [{"lang": "en", "value": "A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. An unprivileged process may be able to terminate a root processes."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "An unprivileged process may be able to terminate a root processes"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-11-05T18:33:44.365Z"}}}, "cveMetadata": {"cveId": "CVE-2025-43365", "state": "PUBLISHED", "dateUpdated": "2025-11-05T18:33:44.365Z", "dateReserved": "2025-04-16T15:24:37.113Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-11-04T01:17:59.138Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "iOS and iPadOS", "vendor": "Apple", "versions": [{"lessThan": "18.7.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "26", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4221CFD-0208-42B8-AACA-1BE6AEC3BA9A", "versionEndExcluding": "26.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "68DCA17A-424E-4EE3-B005-0F2E42407226", "versionEndExcluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26 and iPadOS 26. An unprivileged process may be able to terminate a root processes."}, {"lang": "es", "value": "Un problema de denegaci\u00f3n de servicio se abord\u00f3 con una validaci\u00f3n de entrada mejorada. Este problema est\u00e1 solucionado en iOS 18.7.2 y iPadOS 18.7.2. Un proceso sin privilegios podr\u00eda terminar procesos root."}], "id": "CVE-2025-43365", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43365", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T12:55:21.597700Z", "version": "2.0.3"}}]}, "published": "2025-11-04T02:15:44.037", "references": [{"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/125108"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/125633"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T23:00:55.025703+00:00", "value": {"mitigation_remediation": ["Update the device to iOS 18.7.2 or newer or iPadOS 18.7.2 or newer, which contain the fix for the input validation issue.", "If updating is not immediately possible, limit the execution of untrusted or custom applications to reduce the risk of a local attacker gaining the necessary foothold.", "Ensure that System Integrity Protection and other native security features are enabled to block privileged process termination attempts from unprivileged code."], "summary": {"action": "Apply Update", "impact": "Denial-of-Service via unprivileged process terminating root processes"}, "threat_synthesis": {"affected_systems": "Apple iOS and iPadOS devices running versions older than 18.7.2 and older than iOS/iPadOS 26 are affected. The issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, as well as in iOS 26 and iPadOS 26.", "description_and_impact": "This vulnerability allows an unprivileged process to terminate root processes, resulting in a denial\u2011of\u2011service condition. The weakness is based on improper input validation and is documented as CWE\u201120. The impact is limited to service disruption with no known confidentiality or integrity compromise.", "risk_and_exploitability": "The CVSS score of 2.8 classifies the vulnerability as low severity. The EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and the likely attack vector is local: an attacker with access to run an unprivileged process on the device could exploit the flaw to terminate root processes and cause a DoS."}}}}, "created": "2025-11-04T16:33:02.803349+00:00", "title": "Denial-of-Service Vulnerability Enabling Unprivileged Process to Terminate Root Processes in iOS and iPadOS", "updated": "2026-04-27T23:15:06.042034+00:00", "vendors": ["apple", "apple$PRODUCT$ios", "apple$PRODUCT$ipados"]}