CVE-2025-46305

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-46305", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-04-22T21:13:49.960Z", "datePublished": "2026-02-11T22:58:09.916Z", "dateUpdated": "2026-04-02T18:10:21.139Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "A malicious HID device may cause an unexpected process crash"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.7.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "26.2", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "14.8.4", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "15.7.4", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "26.2", "versionType": "custom"}]}, {"vendor": "Apple", "product": "tvOS", "versions": [{"version": "0", "status": "affected", "lessThan": "26.2", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "0", "status": "affected", "lessThan": "26.2", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"version": "0", "status": "affected", "lessThan": "26.2", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash."}], "references": [{"url": "https://support.apple.com/en-us/125884"}, {"url": "https://support.apple.com/en-us/125886"}, {"url": "https://support.apple.com/en-us/125889"}, {"url": "https://support.apple.com/en-us/125890"}, {"url": "https://support.apple.com/en-us/125891"}, {"url": "https://support.apple.com/en-us/126347"}, {"url": "https://support.apple.com/en-us/126349"}, {"url": "https://support.apple.com/en-us/126350"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:10:21.139Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T17:10:51.796399Z", "id": "CVE-2025-46305", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T18:59:36.484Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-46305", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T17:10:51.796399Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T17:10:19.393Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "15.7", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "14.8", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.7", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/126349"}, {"url": "https://support.apple.com/en-us/126350"}, {"url": "https://support.apple.com/en-us/126347"}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.4, iOS 18.7.5 and iPadOS 18.7.5, macOS Sonoma 14.8.4. A malicious HID device may cause an unexpected process crash."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "A malicious HID device may cause an unexpected process crash"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-02-11T22:58:09.916Z"}}}, "cveMetadata": {"cveId": "CVE-2025-46305", "state": "PUBLISHED", "dateUpdated": "2026-02-13T18:59:36.484Z", "dateReserved": "2025-04-22T21:13:49.960Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2026-02-11T22:58:09.916Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "iOS and iPadOS", "vendor": "Apple", "versions": [{"lessThan": "18.7.5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "26.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "14.8.4", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "15.7.4", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "26.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "tvOS", "vendor": "Apple", "versions": [{"lessThan": "26.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "visionOS", "vendor": "Apple", "versions": [{"lessThan": "26.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "watchOS", "vendor": "Apple", "versions": [{"lessThan": "26.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DF4C0EE-C67C-4BA1-BB50-C51DEC72E486", "versionEndExcluding": "18.7.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "273784FD-F8F0-466D-AF6E-5511FF3781B7", "versionEndExcluding": "18.7.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "E899D2A7-973C-4A46-B479-C245E5DFABE9", "versionEndExcluding": "14.8.4", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5F7A1AF-3DD7-4FA1-BF78-4855F83BB463", "versionEndExcluding": "15.7.4", "versionStartIncluding": "15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash."}, {"lang": "es", "value": "El problema se abord\u00f3 con comprobaciones de l\u00edmites mejoradas. Este problema est\u00e1 corregido en macOS Sequoia 15.7.4, iOS 18.7.5 y iPadOS 18.7.5, macOS Sonoma 14.8.4. Un dispositivo HID malicioso puede causar un cierre inesperado del proceso."}], "id": "CVE-2025-46305", "lastModified": "2026-06-17T09:26:12.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-46305", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T17:10:51.796399Z", "version": "2.0.3"}}]}, "published": "2026-02-11T23:16:03.030", "references": [{"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/125884"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/125886"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/125889"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/125890"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/125891"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126347"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126349"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126350"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,18.7)"}}], "product": "ios_and_ipados", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,15.7)"}}], "product": "macos", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.8)"}}], "product": "macos", "vendor": "apple"}], "analysis": {"en": {"generated_at": "2026-04-27T21:05:15.419839+00:00", "value": {"mitigation_remediation": ["Install the latest OS update provided by Apple that includes the bounds\u2011check fix for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.", "If unable to update immediately, disconnect or disable untrusted HID devices and restrict peripheral access to trusted hardware only.", "Monitor for unexpected process crashes and ensure the system is patched as soon as the official update becomes available."], "summary": {"action": "Apply Patch", "impact": "Denial of Service (process crash)"}, "threat_synthesis": {"affected_systems": "Apple\u2019s iOS and iPadOS platforms up to version 18.7.5 and 26.2, macOS Sequoia up to 15.7.4, macOS Sonoma up to 14.8.4, and macOS Tahoe up to 26.2, as well as tvOS, visionOS, and watchOS versions up to 26.2 are impacted. The targeted devices include iPhones, iPads, Mac computers, Apple TVs, visionOS devices, and Apple Watches.", "description_and_impact": "An untrusted HID device can trigger an improper bounds check within the operating system's input handling, causing a process to crash unexpectedly. The vulnerability is classified as a memory corruption flaw (CWE\u2011119) and results in a denial\u2011of\u2011service condition for the affected process. This crash can be used by an attacker with physical access to disrupt critical applications or system services.", "risk_and_exploitability": "The CVSS score of 5.7 indicates a moderate impact, and the EPSS score of less than 1\u202f% shows that exploitation is unlikely in the current environment. The vulnerability is not listed in the CISA KEV catalog, further suggesting that it is not actively exploited. The attack vector is most likely local, requiring a malicious HID device to be connected to the target device, which means physical access or a compromised peripheral is needed. Given these constraints, the overall risk remains relatively low but still warrants timely patching to avoid potential disruption."}}}}, "created": "2026-02-12T09:03:00.351950+00:00", "title": "HID Device Triggered Bounds Check Failure Causing OS Crash", "updated": "2026-04-27T21:15:05.541967+00:00", "vendors": ["apple", "apple$PRODUCT$ios_and_ipados", "apple$PRODUCT$macos"]}