Apple iOS, macOS, and iPadOS Kernel Memory Corruption Vulnerability (CVE-2025-43520)
Executive & SecOps Summary
SECOPS ASSESSMENTApple operating systems prior to iOS 18.7.2, macOS Sequoia 15.7.2, and other legacy versions
A local malicious application can trigger unexpected system termination or write directly to kernel memory, potentially leading to privilege escalation
Immediately apply the official security updates released by Apple (iOS 18.7.2, macOS 15.7.2, etc.)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Apply Official Security Patches
Update all affected Apple devices to the latest patched versions immediately.
- iOS / iPadOS: Navigate to
Settings > General > Software Updateand install iOS 18.7.2 / iPadOS 18.7.2 or later. - macOS: Navigate to
System Settings > General > Software Updateand install macOS Sequoia 15.7.2 or macOS Sonoma 14.8.2 or later.
2. Enterprise MDM Enforcement
IT and security administrators should leverage Mobile Device Management (MDM) profiles to enforce OS updates and restrict corporate network access for non-compliant, outdated devices.
Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
CVE-2025-43520 is a critical memory corruption vulnerability affecting multiple Apple operating systems. The root cause lies in improper memory handling (CWE-120) within the system kernel or privileged components.
A local malicious application installed on the target device can exploit this flaw by passing crafted inputs to vulnerable system interfaces. This triggers a memory corruption state, allowing the attacker to cause a kernel panic (denial of service) or write arbitrary data into restricted kernel memory spaces. Such kernel-level write capabilities are frequently chained to bypass application sandboxing and achieve full device compromise. Given its inclusion in the CISA KEV catalog, active exploitation has been observed in the wild, making immediate remediation imperative.
Official Vendor Advisories & References
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.