CISA KEV · Known exploitedMedium

CVE-2025-43520

Apple Multiple Products

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.

CVSS
5.5
EPSS
0.42%
34.3% percentile
CISA KEV
Listed
Published
2025.12.13
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability0.42%
Technical severityCVSS 5.5

Vulnerability overview

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.

Affected product and versions

Product
Apple Multiple Products
Affected versions
< 18.7.2, 26.0, >= 14.0 < 14.8.2, >= 15.0 < 15.7.2, < 26.1
Fixed versions
18.7.2, 14.8.2, 15.7.2, 26.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Due date: 2026.04.03
  1. 1
    Identify

    Confirm that Apple Multiple Products and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-120
KEV added
2026.03.20
Ransomware use
미확인
CVE-2025-43520 — Apple Multiple Products | SECUFOCUS NOW