5.5

CVE-2025-43520: Apple Multiple Products Classic Buffer Overflow Vulnerability

CVSS: 5.5v3.1MediumKEVAnalyzed
Published 12-12-2025Last modified 21-09-2026
Open JSON

Vulnerability summary

CVE-2025-43520 is a medium (CVSS 5.5) Classic Buffer Overflow vulnerability in Apple Multiple Products. It is known to be exploited: CISA lists it, first on 20-03-2026. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.7% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 12-12-2025
    PublishedVulnerability first disclosed.
  2. 20-03-2026
    Added to CISA KEVApple Multiple Products Classic Buffer Overflow Vulnerability
  3. 03-04-2026
    CISA remediation dueApply mitigations per vendor instructions.
  4. 21-09-2026
    Last modifiedVulnerability information updated.

Description

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

0.00 pp

From 0.43% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.43%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
20-03-2026
Federal due date
03-04-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. support.apple.com/en-us/125632 support.apple.com/en-us/125633 support.apple.com/en-us/125634 support.apple.com/en-us/125635 support.apple.com/en-us/125636 support.apple.com/en-us/125637 support.apple.com/en-us/125638 support.apple.com/en-us/125639 nvd.nist.gov/vuln/detail/CVE-2025-43520

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apple7 products

1 vendor · 7 products

References

10 links