CVE-2025-43299

Vulnerability

Overview

CVE-2025-43299 is a denial-of-service issue in Apple operating systems that can be triggered by an app. The root cause is a validation flaw that, when exploited, leads to unexpected system termination. Apple addressed the issue with improved validation in the latest software updates [1][2].

Exploitation

An attacker would need to have an app running on the affected device to exploit this vulnerability. No special privileges or network access are required beyond the ability to execute code on the system. The attack surface is local, meaning the app must be installed and run on the target the vulnerable component [1][2].

Impact

Successful exploitation results in a denial-of-service condition, causing the system to terminate unexpectedly. This can lead to loss of unsaved work and temporary unavailability of the device. The vulnerability does not disclose further technical details, but the impact is limited impact is limited to system stability [1][2].

Mitigation

Apple has released patches for iOS 18.7, iPadOS 18.7, macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26. Users are advised to update their devices to the latest available versions to mitigate the risk [1][2][3][4].