CVE-2025-43379
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
This issue was addressed with improved validation of symlinks. The vulnerability is fixed in iOS 26.1, iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1. An app may be able to access protected user data.
Risk Assessment
An app could bypass protections and access protected user data, potentially compromising privacy. The risk affects multiple Apple platforms without updates.
Recommendation
Update all Apple devices (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) to version 26.1 or the appropriate macOS versions (Sequoia 15.7.2, Sonoma 14.8.2, Tahoe 26.1).
Other vulnerabilities in iOS, iPadOS, macOS, tvOS, visionOS, watchOS
See all- CVE-2026-65350High
A use-after-free issue was addressed with improved memory management. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. An app may cause unexpected system termination or corrupt kernel memory.
- CVE-2026-113950Medium
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
- CVE-2026-112546Low risk· EPSS 12%
An out-of-bounds read was addressed with improved bounds checking. Processing a maliciously crafted file may lead to unexpected app termination.
- CVE-2026-112518Low risk· EPSS 13%
A signature validation issue in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS was addressed with improved checks. An attacker in a privileged network position may be able to impersonate a Kerberos KDC.
- CVE-2026-112501Low risk· EPSS 14%
A race condition was addressed with improved state handling. The issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2, and an app may be able to cause unexpected system termination.
- CVE-2026-112477Low risk· EPSS 14%
A race condition was addressed with improved locking. An app may be able to cause unexpected system termination or corrupt kernel memory.
- CVE-2026-112476Low risk· EPSS 14%
An out-of-bounds read was addressed with improved bounds checking. An app may be able to cause unexpected system termination.
- CVE-2026-112474Low risk· EPSS 13%
A use-after-free issue was addressed with improved memory management. An app may be able to cause unexpected system termination or write kernel memory.
- CVE-2026-112470Low risk· EPSS 14%
An out-of-bounds write issue was addressed with improved bounds checking. An app may be able to cause unexpected system termination or corrupt kernel memory.
- CVE-2026-112446Low risk· EPSS 14%
This issue was addressed with additional entitlement checks. The issue affects iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27 and 27.2, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27.2, visionOS 27.2, and watchOS 27.2. An app may be able to access sensitive user data.
Original NVD description (English source)
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to access protected user data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS