CVE-2025-43520: Apple OS kernel memory corruption via malicious app

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCISA KEV listing indicates active exploitation, but the local-only vector, low privileges needed, and availability-only CVSS impact limit severity to high rather than critical.

What it is

A memory corruption flaw (classic buffer overflow) in Apple's kernel was fixed across iOS, iPadOS, macOS, tvOS, visionOS and watchOS. A malicious application can trigger it to cause unexpected system termination or write kernel memory, making it a local privilege-escalation and denial-of-service risk on unpatched devices.

Impact

An attacker who can run a malicious app on the device may corrupt kernel memory, potentially escalating privileges or crashing the system. The CVSS vector rates only availability impact (A:H) with no confidentiality or integrity impact.

Attack surface

Reached locally by a malicious application already running on the target device; the vector AV:L/PR:L/UI:N indicates low privileges are required and no user interaction beyond running the app. No remote or network vector is described.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2026-03-20, indicating active exploitation, though EPSS is low (0.00425, ~36th percentile) and no ransomware use is documented. A Google Threat Intelligence reference describes a DarkSword iOS exploit chain, suggesting real-world exploitation.

What to do

• Update to the fixed versions: iOS/iPadOS 18.7.2 or 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1.
• Follow CISA KEV required action and BOD 22-01 guidance; discontinue use if mitigations are unavailable.
• Restrict installation of untrusted or sideloaded applications on managed Apple devices.
• Enforce rapid patch compliance for Apple endpoints via MDM.
• Monitor for unexpected kernel panics or system terminations on Apple devices as a possible exploitation indicator.

Detection

• Alert on unexpected kernel panics or repeated system terminations on Apple endpoints.
• Monitor for installation or execution of untrusted/sideloaded apps on managed devices.
• Track patch state of Apple devices against the fixed OS versions and flag unpatched assets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.