CVE-2025-43365

Root

Cause CVE-2025-43365 is a denial-of-service vulnerability in iOS and iPadOS. The issue stems from an out-of-bounds access that occurs when the system handles certain input. Apple addressed this by improving bounds checking, which prevents the out-of-bounds condition [1].

Exploitation

An unprivileged process (e.g., a third-party app) can exploit this flaw without requiring elevated privileges. The attack surface is local, meaning the attacker must already have the ability to run code on the device. No user interaction is needed beyond launching the malicious app [1][2].

Impact

Successful exploitation allows an unprivileged process to terminate root processes, leading to unexpected system termination. This can cause a denial of service, potentially crashing the device or disrupting critical system services [1].

Mitigation

Apple has released patches in iOS 18.7.2 and iPadOS 18.7.2 (released November 5, 2025) and in iOS 26 and iPadOS 26 (released September 15, 2025). Users should update to the latest available version for their device. The vulnerability affects a wide range of devices, including iPhone 11 and later, and various iPad models [1][2].