CVE-2025-46301 - Vulnerability Details

- Unexpected Process Crash via Malicious HID Device

Description

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash.

Published: 2026-02-11

Score: 5.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from insufficient bounds checking in the handling of Human Interface Device (HID) input, a classic buffer overflow (CWE-119). A malicious HID device can exploit this flaw, causing the affected process to crash unexpectedly. The result is a denial of service condition that can interrupt service and degrade user experience.

Affected Systems

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The specific versions impacted by this flaw include iOS 18.7.5, iPadOS 18.7.5, iOS 26.2, iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2.

Risk and Exploitability

The CVSS score of 5.7 indicates a moderate severity, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. The attack vector is likely physical; an attacker must supply a malicious HID device to the target system. Once the device is connected, the flaw will trigger an immediate crash of the victim process, providing potential for denial of service in the affected Apple operating systems.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.5
`0`	affected	< 26.2

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 14.8.4
`0`	affected	< 15.7.4
`0`	affected	< 26.2

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.2

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.2

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.2

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

—

Version	Status	Scheme	Platform
`[0,18.7)`	affected	generic	—

Apple

Macos

—

Version	Status	Scheme	Platform
`[0,15.7)`	affected	generic	—

Apple

Macos

—

Version	Status	Scheme	Platform
`[0,14.8)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update all affected Apple operating systems to the latest available versions, such as iOS 18.7.5/26.2, iPadOS 18.7.5/26.2, macOS Sequoia 15.7.4 or Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2.
Limit physical access to the device and avoid connecting untrusted or unknown HID devices, ensuring that only authorized hardware is used.
Configure system or application policies to reject or quarantine untrusted HID inputs when such options exist, and monitor device logs for unexpected crashes related to HID activity.

Generated by OpenCVE AI on April 22, 2026 at 19:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00012.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/125884
https://support.apple.com/en-us/125886
https://support.apple.com/en-us/125889
https://support.apple.com/en-us/125890
https://support.apple.com/en-us/125891
https://support.apple.com/en-us/126347
https://support.apple.com/en-us/126349
https://support.apple.com/en-us/126350

History

Wed, 22 Apr 2026 20:15:00 +0000

Type	Values Removed	Values Added
Title		Unexpected Process Crash via Malicious HID Device

Thu, 02 Apr 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.4, iOS 18.7.5 and iPadOS 18.7.5, macOS Sonoma 14.8.4. A malicious HID device may cause an unexpected process crash.	The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash.
References		https://support.apple.com/en-us/125884 https://support.apple.com/en-us/125886 https://support.apple.com/en-us/125889 https://support.apple.com/en-us/125890 https://support.apple.com/en-us/125891

Fri, 13 Feb 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}`

Fri, 13 Feb 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos::::::::
Vendors & Products		Apple ipados Apple iphone Os

Thu, 12 Feb 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 12 Feb 2026 09:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos
Vendors & Products		Apple Apple ios And Ipados Apple macos

Wed, 11 Feb 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.4, iOS 18.7.5 and iPadOS 18.7.5, macOS Sonoma 14.8.4. A malicious HID device may cause an unexpected process crash.
References		https://support.apple.com/en-us/126347 https://support.apple.com/en-us/126349 https://support.apple.com/en-us/126350

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-02-11T22:58:46.183Z

Updated: 2026-04-02T18:22:02.570Z

Reserved: 2025-04-22T21:13:49.960Z

Link: CVE-2025-46301

Vulnrichment

Updated: 2026-02-12T16:35:35.717Z

NVD

Status : Modified

Published: 2026-02-11T23:16:02.630

Modified: 2026-04-02T19:21:05.527

Link: CVE-2025-46301

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-22T20:00:08Z

Weaknesses

CWE-119

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object