Apple Products Memory Corruption Vulnerability
Summary
CISA has updated its Known Exploited Vulnerabilities (KEV) catalog to include CVE-2025-43510, a memory corruption vulnerability affecting various Apple products. The vulnerability, which could allow a malicious application to cause unexpected memory changes, has been addressed by Apple in recent software updates.
What changed
CISA has added CVE-2025-43510 to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability involves a memory corruption issue in Apple products, including watchOS, iOS, iPadOS, macOS, and tvOS, which could be exploited by a malicious application to alter shared memory. Apple has released patches for affected versions, such as watchOS 26.1, iOS 18.7.2, macOS Sonoma 14.8.2, and others.
Organizations utilizing affected Apple devices should prioritize applying the latest software updates provided by Apple to mitigate the risk of exploitation. The inclusion in the KEV catalog suggests active exploitation or a high likelihood of exploitation, making timely patching critical for maintaining system security and preventing potential data breaches or system instability.
What to do next
- Apply Apple software updates to affected devices (watchOS, iOS, iPadOS, macOS, tvOS).
- Review CISA's KEV catalog for active exploitation risks.
- Ensure robust vulnerability management processes are in place for all endpoints.
Source document (simplified)
Required CVE Record Information
CNA: Apple Inc.
Description
A memory corruption issue was addressed with improved lock state checking. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, tvOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.
Product Status
Learn more Versions 1 Total
Default Status: unknown
affected
- affected before 14.8 Versions 1 Total
Default Status: unknown
affected
- affected before 26.1 Versions 1 Total
Default Status: unknown
affected
- affected before 26.1 Versions 1 Total
Default Status: unknown
affected
- affected before 26.1 Versions 1 Total
Default Status: unknown
affected
- affected before 26.1 Versions 1 Total
Default Status: unknown
affected
- affected before 15.7 Versions 1 Total
Default Status: unknown
affected
- affected before 26.1 Versions 1 Total
Default Status: unknown
affected
- affected before 18.7
References 8 Total
- https://support.apple.com/en-us/125636
- https://support.apple.com/en-us/125637
- https://support.apple.com/en-us/125634
- https://support.apple.com/en-us/125638
- https://support.apple.com/en-us/125639
- https://support.apple.com/en-us/125635
- https://support.apple.com/en-us/125632
- https://support.apple.com/en-us/125633
Authorized Data Publishers
CISA-ADP
Updated:
2026-03-20
SSVC and KEV, plus CVSS and CWE if not provided by the CNA.
SSVC 1 Total
Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| none | no | total | 2.0.3 | 2026-03-19 |
KEV 1 Total
Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43510 (2026-03-20)
CWE 1 Total
Learn more
- CWE-667: CWE-667 Improper Locking
CVSS 1 Total
Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 7.8 | HIGH | 3.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Data Privacy & Cybersecurity alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when CISA ICS-CERT Advisories publishes new changes.