Description
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may result in disclosure of process memory.
Published: 2025-07-29
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Disclosure
Action: Patch
AI Analysis

Impact

A flaw in macOS can cause the processing of a maliciously crafted image to expose fragments of a process’s memory, revealing confidential data such as cryptographic keys or passwords. This vulnerability is defined as an information‑exposure flaw (CWE‑200) and does not provide arbitrary code execution.

Affected Systems

The issue affects all macOS releases prior to Sequoia 15.6. Apple implemented mitigations in macOS Sequoia 15.6, correcting the flawed checks that allowed unvalidated image data to cause memory disclosure.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate risk, while an EPSS score of less than 1 % implies a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and the description does not specify any access or privilege requirements; the attack appears to rely simply on supplying a crafted image to the image‑processing subsystem.

Generated by OpenCVE AI on April 28, 2026 at 10:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade macOS to Sequoia 15.6 or later, where the issue has been addressed.
  • Ensure image‑handling components are updated to versions that include the patch before processing external images.
  • Apply sandboxing or strict input validation to restrict or isolate the processing of untrusted image files, reducing the risk of memory disclosure.

Generated by OpenCVE AI on April 28, 2026 at 10:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-23130 The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may result in disclosure of process memory.
History

Tue, 28 Apr 2026 11:15:00 +0000

Type Values Removed Values Added
Title Image Processing Memory Disclosure in macOS

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Thu, 31 Jul 2025 20:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Thu, 31 Jul 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Jul 2025 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Apple macos Sequoia
Vendors & Products Apple
Apple macos
Apple macos Sequoia

Tue, 29 Jul 2025 23:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may result in disclosure of process memory.
References

Subscriptions

Apple Macos Macos Sequoia
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:08:30.607Z

Reserved: 2025-04-16T15:24:37.089Z

Link: CVE-2025-43215

cve-icon Vulnrichment

Updated: 2025-07-30T13:27:21.757Z

cve-icon NVD

Status : Modified

Published: 2025-07-30T00:15:33.603

Modified: 2025-11-03T20:18:52.650

Link: CVE-2025-43215

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T11:00:14Z

Weaknesses