CVE-2025-43205

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6,…

Medium4.0EPSS 0.16%

Published: 12 Nov 2025
Updated: 2 Apr 2026
Reserved: 16 Apr 2025
Assigned by: apple

Description

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to bypass ASLR.

Scores

CVSS scores of CVE-2025-43205, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	Medium4.0	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Modified	3.1	Medium4.0	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS (exploitation in 30 days): 0.16% · top 95% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.0.

Weakness

An app may be able to bypass ASLR
CWE-125 Out-of-bounds Read (opens in a new tab)All about CWE-125 and its CVEs

Affected products

Apple · iOS and iPadOS
- affected < 18.4
Apple · iPadOS
- affected < 17.7.6
Apple · macOS
- affected < 13.7.5
- affected < 14.7.5
- affected < 15.4
Apple · tvOS
- affected < 18.4
Apple · visionOS
- affected < 2.4
Apple · watchOS
- affected < 11.4

References (8)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-43205](https://trackcve.app/badge/CVE-2025-43205.svg)](https://trackcve.app/cve/CVE-2025-43205)

Record last updated 2 Apr 2026, 18:12 UTC.