Paper/Archive/CVE-2025-43347

CVE-2025-43347

Apple iOS and iPadOS — This issue was addressed by removing the vulnerable code.

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 60.4.604 × 2012.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An input validation issue was addressed.

Affected

ProductAffectedFixed inSource

iOS and iPadOS< 2626CNA

macOS< 2626CNA

tvOS< 2626CNA

visionOS< 2626CNA

watchOS< 2626CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.apple.com/en-us/125108 refsupport.apple.com/en-us/125110 refsupport.apple.com/en-us/125114 refsupport.apple.com/en-us/125115 refsupport.apple.com/en-us/125116 refseclists.org/fulldisclosure/2025/Sep/57 refseclists.org/fulldisclosure/2025/Sep/56 refseclists.org/fulldisclosure/2025/Sep/53 refseclists.org/fulldisclosure/2025/Sep/58 refseclists.org/fulldisclosure/2025/Sep/49