CVE-2025-46280

Vulnerability

An out-of-bounds read vulnerability exists in macOS Tahoe 26, addressed with improved bounds checking. The issue is present in versions prior to macOS Tahoe 26, which includes Mac Studio (2022 and later), iMac (2020 and later), Mac Pro (2019 and later), Mac mini (2020 and later), MacBook Air with Apple silicon (2020 and later), MacBook Pro (13-inch, 2020, Four Thunderbolt 3 ports), and MacBook Pro with Apple silicon (2020 and later) [1]. The specific affected component is not detailed in the available reference.

Exploitation

An app may exploit this issue, requiring only the ability to execute code on the system. No special privileges or user interaction beyond launching the app are indicated in the advisory [1]. The out-of-bounds read can be triggered by the app, leading to system termination.

Impact

Successful exploitation could cause unexpected system termination, resulting in a denial of service (availability impact). No information disclosure or privilege escalation is indicated in the available reference [1].

Mitigation

Apple has fixed this issue in macOS Tahoe 26, released September 15, 2025 [1]. Users should update to this version. No workarounds are provided in the reference.