CVE-2025-43377

Out-of-Bounds Read Causing DoS in Apple iOS, iPadOS, and macOS

Published Nov 4, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to cause a denial-of-service.

Analysis

Technical impact

An out‑of‑bounds read can be triggered by a mobile or desktop application, causing the operating system to crash and exhibit a denial‑of‑service. The flaw is a classic bounds‑checking error, classified as CWE‑125. The official description does not indicate that it exposes confidential data or allows code execution; it only states that an app may be able to cause a crash.

Affected Systems

Apple’s iOS 18.7.2, iPadOS 18.7.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1 contain the fix. Devices running earlier releases are presumed to be vulnerable because the description does not list any other mitigated versions; the vulnerability applies to any hardware running those operating system versions.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. Based on the description that an application can trigger a crash, it is inferred that the vulnerability can only be exploited from within an application, implying a local denial‑of‑service vector. The issue is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.2

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 15.7.2
`0`	affected	< 26.1

Configuration 1 [-]

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Apple	Macos	—
Apple	Macos Sequoia	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update all affected Apple devices to at least iOS 18.7.2, iPadOS 18.7.2, macOS Sequoia 15.7.2, or macOS Tahoe 26.1.
If a vulnerable application cannot be updated immediately, uninstall or otherwise prevent its execution to avoid crashes.
Configure monitoring to log and alert on application crashes that may be related to this out‑of‑bounds read issue.

Generated by OpenCVE AI on April 29, 2026 at 02:02 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.189% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/125633
https://support.apple.com/en-us/125634
https://support.apple.com/en-us/125635

History

Apr 29, 2026 2:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Out-of-Bounds Read Causing DoS in Apple iOS, iPadOS, and macOS

Dec 17, 2025 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. An app may be able to cause a denial-of-service.	An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to cause a denial-of-service.
References		https://support.apple.com/en-us/125634 https://support.apple.com/en-us/125635

Nov 5, 2025 7:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://support.apple.com/en-us/125635

Nov 5, 2025 6:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.2. An app may be able to cause a denial-of-service.	An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. An app may be able to cause a denial-of-service.
References		https://support.apple.com/en-us/125633

Nov 4, 2025 5:00 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:apple:macos::::::::

Nov 4, 2025 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Apple macos Sequoia
Vendors & Products		Apple Apple macos Apple macos Sequoia

Nov 4, 2025 2:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 4, 2025 1:45 AM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.2. An app may be able to cause a denial-of-service.
References		https://support.apple.com/en-us/125635