CVE-2025-43384 Details
Description
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
A vulnerability allowing out-of-bounds access has been identified in multiple Apple products, including iOS, iPadOS, tvOS, visionOS, and macOS Sequoia. This vulnerability arises in the Core Text and Model I/O components, where improper input validation of media files can lead to memory corruption or unexpected application termination. The issue has been addressed with improved bounds checking and input validation.
Users can update to iOS 26.1, iPadOS 26.1, tvOS 26.1, visionOS 26.1, or macOS Sequoia 15.7.2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 15, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apple ipados | < 26.1 |
CPE
Remediation
| |
| apple iphone os | < 26.1 |
CPE
Remediation
| |
| apple macos | < 15.7.2 |
CPE
Remediation
| |
| apple tvos | < 26.1 |
CPE
Remediation
| |
| apple visionos | < 26.1 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 2, 2026 | CVE Modified | [email protected] |
| Dec 17, 2025 | CVE Modified | [email protected] |
| Nov 5, 2025 | CVE Modified | [email protected] |
| Nov 4, 2025 | Initial Analysis | [email protected] |
| Nov 4, 2025 | CVE Modified | CISA-ADP |
| Nov 4, 2025 | New CVE Received | [email protected] |