CVE-2025-46303

Vulnerability

Overview

CVE-2025-46303 is a vulnerability in Apple's Human Interface Device (HID) subsystem. The root cause is insufficient bounds checks when processing input from HID devices, which can be exploited by a malicious device to trigger an unexpected process crash. The issue was addressed with improved bounds checks in the affected code.

Exploitation

Exploitation requires physical access to the target device to connect a malicious HID device, such as a USB keyboard or other input device. No authentication is needed once the device is plugged in, making this a local attack vector that could be used in scenarios where an attacker has brief physical access.

Impact

A successful exploit causes an unexpected process crash, leading to a denial of service. While the crash may be limited to a single process, it could disrupt system functionality or be used as part of a larger attack chain.

Mitigation

Apple has released security updates that fix this vulnerability across multiple platforms, including iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2 [1][2][3][4]. Users are advised to update their devices to the latest available versions to mitigate the risk.