medium5.5Known exploited
CVE-2025-43520
Apple Multiple Products Classic Buffer Overflow Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-03-20. Federal due date: 2026-04-03.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Ipados | before 18.7.2 Version 26.0 |
| Apple | Iphone Os | before 18.7.2 Version 26.0 |
| Apple | Macos | from 14.0 before 14.8.2 from 15.0 before 15.7.2 Version 26.0 |
| Apple | Tvos | before 26.1 |
| Apple | Visionos | before 26.1 |
| Apple | Watchos | before 26.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://support.apple.com/en-us/125632
- https://support.apple.com/en-us/125633
- https://support.apple.com/en-us/125634
- https://support.apple.com/en-us/125635
- https://support.apple.com/en-us/125636
- https://support.apple.com/en-us/125637
- https://support.apple.com/en-us/125638
- https://support.apple.com/en-us/125639
- https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43520