CVE-2025-43510: Apple OS memory corruption via improper lock state checking

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with a known exploit chain reference and high CVSS impact, though exploitation requires local access and user interaction.

What it is

A memory corruption flaw in Apple's operating systems stems from improper lock state checking, allowing a malicious application to cause unexpected changes in memory shared between processes. It affects iOS, iPadOS, macOS, tvOS, visionOS and watchOS and is fixed in the listed December 2025 releases. Because it is in CISA KEV and tied to a published iOS exploit chain, defenders should treat it as actively targeted.

Impact

An attacker with a malicious app on the device can corrupt shared memory, potentially leading to data tampering or code execution in the context of other processes. The CVSS vector rates high confidentiality, integrity and availability impact.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges (PR:N), meaning the attacker must get a malicious application onto the device and convince the user to run or trigger it. No remote or unauthenticated network path is described.

Exploitation

CVE-2025-43510 is listed in CISA KEV with a due date of 2026-04-03, and a reference tagged Technical Description points to a Google Threat Intelligence writeup on a DarkSword iOS exploit chain. EPSS is low at 0.00355 (29th percentile), but KEV inclusion indicates known exploitation.

What to do

• Update to the fixed versions: iOS/iPadOS 18.7.2 or 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1.
• Follow CISA BOD 22-01 guidance and apply vendor mitigations or discontinue use where patching is not possible.
• Restrict installation of applications to trusted sources and enforce mobile device management policies that block sideloaded or untrusted apps.
• Monitor Apple security advisories for any revised guidance or additional affected versions.
• Prioritize patching of internet-facing and high-value macOS and iOS devices first.

Detection

• Hunt for unexpected or unauthorized application installs on managed Apple devices, especially those matching known malicious app indicators.
• Monitor for crashes or anomalous behavior in processes that share memory, which may indicate exploitation attempts.
• Review endpoint telemetry for signs of post-exploitation activity following a malicious app launch, such as unusual inter-process memory access.
• Track patch compliance against the fixed OS versions and flag devices still running vulnerable builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.