CVE-2025-43520

CVE-2025-43520 is a classic buffer overflow (CWE-120) in the kernel of multiple Apple operating systems, a memory corruption issue that Apple resolved with improved memory handling. It is triggered locally: a malicious application already running on a vulnerable iPhone, iPad, Mac, Apple TV, Apple Vision Pro, or Apple Watch can corrupt kernel memory without user interaction or special privileges. An attacker gains the ability to write kernel memory and can cause unexpected system termination (crash/denial of service), reflected in the CVSS 5.5 score (local attack, low privileges, high availability impact). All users of Apple devices running versions earlier than the fixed releases are affected: iOS/iPadOS before 18.7.2 or 26.1, macOS Sequoia before 15.7.2, macOS Sonoma before 14.8.2, macOS Tahoe before 26.1, and tvOS, visionOS, and watchOS before 26.1. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-20 with a federal patching deadline of April 3, 2026, and press reports link the Apple bugs to the recently surfaced DarkSword iOS exploit kit, confirming exploitation in the wild.

What to do: Update every Apple device to its platform's fixed release: iOS/iPadOS 18.7.2 or 26.1; macOS Sequoia 15.7.2, Sonoma 14.8.2, or Tahoe 26.1; tvOS 26.1; visionOS 26.1; watchOS 26.1. Federal agencies must apply the updates by the BOD 22-01 deadline of April 3, 2026, and all organizations should prioritize fleet devices and BYOD endpoints that install or run untrusted applications, since exploitation requires local code execution. Check the installed OS version in device settings and treat anything below the fixed versions as vulnerable.