Description
The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory.
Published: 2025-03-31
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption that can compromise system integrity
Action: Patch
AI Analysis

Impact

An attacker can exploit a bounds check flaw in macOS that allows an application to corrupt coprocessor memory. This flaw is rooted in improper bounds validation (CWE-119) and could lead to unintended data modification or execution of arbitrary code, potentially compromising the entire operating system.

Affected Systems

Apple macOS systems running versions prior to Sequoia 15.4 are affected. The vulnerability was fixed in macOS Sequoia 15.4 and later releases. Users of older macOS releases should consult the Apple Support article for guidance on upgrading.

Risk and Exploitability

The CVSS score of 7.4 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a local application that directly accesses the coprocessor. An attacker would need to execute or trick a user into running a malicious app that abuses the bounds check to corrupt memory.

Generated by OpenCVE AI on April 28, 2026 at 02:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the macOS Sequoia 15.4 update or later to apply the corrected bounds checking logic.
  • Apply the App Sandbox or another least‑privilege model to restrict which applications can interact with the coprocessor.
  • Continuously monitor system logs for anomalous coprocessor memory activity and review any process that obtains elevated privileges to use coprocessor resources.

Generated by OpenCVE AI on April 28, 2026 at 02:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-8918 The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory.
History

Tue, 28 Apr 2026 03:00:00 +0000

Type Values Removed Values Added
Title Bounds Check Bypass Allows Coprocessor Memory Corruption

Mon, 03 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Fri, 04 Apr 2025 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos

Tue, 01 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Mar 2025 22:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:21:03.394Z

Reserved: 2025-03-22T00:04:43.717Z

Link: CVE-2025-30437

cve-icon Vulnrichment

Updated: 2025-11-03T21:14:33.266Z

cve-icon NVD

Status : Modified

Published: 2025-03-31T23:15:25.783

Modified: 2025-11-03T22:18:45.610

Link: CVE-2025-30437

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T02:45:11Z

Weaknesses