CVE-2025-43374

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43374", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-04-16T15:24:37.115Z", "datePublished": "2025-11-21T21:22:23.229Z", "dateUpdated": "2026-04-02T18:18:58.447Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "An attacker in physical proximity may be able to cause an out-of-bounds read in kernel memory"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "17.7.7", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "13.7.3", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "14.7.3", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "15.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "tvOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "0", "status": "affected", "lessThan": "2.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"version": "0", "status": "affected", "lessThan": "11.5", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.5, visionOS 2.5, watchOS 11.5. An attacker in physical proximity may be able to cause an out-of-bounds read in kernel memory."}], "references": [{"url": "https://support.apple.com/en-us/122069"}, {"url": "https://support.apple.com/en-us/122070"}, {"url": "https://support.apple.com/en-us/122404"}, {"url": "https://support.apple.com/en-us/122405"}, {"url": "https://support.apple.com/en-us/122716"}, {"url": "https://support.apple.com/en-us/122720"}, {"url": "https://support.apple.com/en-us/122721"}, {"url": "https://support.apple.com/en-us/122722"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:18:58.447Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-23T11:29:10.371858Z", "id": "CVE-2025-43374", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-23T11:29:17.964Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-43374", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-23T11:29:10.371858Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-23T11:28:30.623Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "14.7", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "15.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "17.7", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "11.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "13.7", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/122069"}, {"url": "https://support.apple.com/en-us/122716"}, {"url": "https://support.apple.com/en-us/122405"}, {"url": "https://support.apple.com/en-us/122404"}, {"url": "https://support.apple.com/en-us/122721"}, {"url": "https://support.apple.com/en-us/122722"}, {"url": "https://support.apple.com/en-us/122070"}], "descriptions": [{"lang": "en", "value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, visionOS 2.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, macOS Sequoia 15.5, watchOS 11.5. An attacker in physical proximity may be able to cause an out-of-bounds read in kernel memory."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "An attacker in physical proximity may be able to cause an out-of-bounds read in kernel memory"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-11-21T21:22:23.229Z"}}}, "cveMetadata": {"cveId": "CVE-2025-43374", "state": "PUBLISHED", "dateUpdated": "2025-11-23T11:29:17.964Z", "dateReserved": "2025-04-16T15:24:37.115Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-11-21T21:22:23.229Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "iOS and iPadOS", "vendor": "Apple", "versions": [{"lessThan": "18.5", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "iPadOS", "vendor": "Apple", "versions": [{"lessThan": "17.7.7", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "13.7.3", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "14.7.3", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "15.5", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "tvOS", "vendor": "Apple", "versions": [{"lessThan": "18.5", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "visionOS", "vendor": "Apple", "versions": [{"lessThan": "2.5", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "watchOS", "vendor": "Apple", "versions": [{"lessThan": "11.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "683ECAF8-DB29-40DB-963A-B95EA2A2AC01", "versionEndExcluding": "17.7.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "069735D6-38B4-402A-9E79-1961701C9AD3", "versionEndExcluding": "18.5", "versionStartIncluding": "18.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF6AAC00-F384-4B0D-BBA9-C2AD278BF653", "versionEndExcluding": "18.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "A12642CB-69CC-4C6E-A2C2-CA8AE736EE88", "versionEndExcluding": "13.7.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "9C523C7E-B1CF-454B-8AFD-B462C5120D9E", "versionEndExcluding": "14.7.3", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7416C76-07EC-4132-A509-E3F62B002CCA", "versionEndExcluding": "15.5", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "matchCriteriaId": "047CDCCE-04BB-4D43-9831-7694992C5CC4", "versionEndExcluding": "2.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CBDEF1C-6D76-4F9D-8433-3AC16F3860F4", "versionEndExcluding": "11.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.5, visionOS 2.5, watchOS 11.5. An attacker in physical proximity may be able to cause an out-of-bounds read in kernel memory."}, {"lang": "es", "value": "Una lectura fuera de l\u00edmites se corrigi\u00f3 con una comprobaci\u00f3n de l\u00edmites mejorada. Este problema se corrigi\u00f3 en iPadOS 17.7.7, iOS 18.5 y iPadOS 18.5, visionOS 2.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, macOS Sequoia 15.5, watchOS 11.5. Un atacante en proximidad f\u00edsica podr\u00eda ser capaz de causar una lectura fuera de l\u00edmites en la memoria del kernel."}], "id": "CVE-2025-43374", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43374", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-23T11:29:10.371858Z", "version": "2.0.3"}}]}, "published": "2025-11-21T22:16:19.863", "references": [{"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122069"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122070"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122404"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122405"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122716"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/122720"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122721"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122722"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T22:47:33.223294+00:00", "value": {"mitigation_remediation": ["Apply the latest operating\u2011system updates to the affected devices (iOS 18.5, iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.5, visionOS 2.5, watchOS 11.5).", "Restrict physical access to devices so that untrusted personnel cannot approach the target. This reduces the likelihood of a successful local exploit. ", "Enable device management controls that enforce secure boot and restrict kernel modifications, ensuring the bounds\u2011checking logic cannot be bypassed. ", "If an update cannot be applied immediately, isolate the device on a separate security segment and monitor for anomalous memory reads."], "summary": {"action": "Patch", "impact": "Kernel memory read may expose sensitive data"}, "threat_synthesis": {"affected_systems": "Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The flaw is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.5, visionOS 2.5, and watchOS 11.5. Versions prior to those listed remain vulnerable.", "description_and_impact": "An out\u2011of\u2011bounds read was detected in kernel memory. When exploited the attacker could read protected data, potentially leading to information disclosure. The weakness arises from insufficient bounds checking prior to the read operation, as identified by CWE\u2011121. The same flaw persists across multiple Apple operating systems but is mitigated by applying the latest security updates.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a medium impact with a modest exploitation potential. The EPSS score is less than 1%, demonstrating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack requires physical proximity to the target device, making the threat local. An attacker with such access could trigger the off\u2011by\u2011one read and retrieve kernel data."}}}}, "created": "2025-11-24T09:08:04.577943+00:00", "title": "Out\u2011of\u2011Bounds Kernel Read in Apple Operating Systems", "updated": "2026-04-27T23:00:13.958795+00:00", "vendors": ["apple", "apple$PRODUCT$ios", "apple$PRODUCT$ipados", "apple$PRODUCT$macos", "apple$PRODUCT$macos_sequoia", "apple$PRODUCT$macos_sonoma", "apple$PRODUCT$macos_ventura", "apple$PRODUCT$visionos", "apple$PRODUCT$watchos"]}