CVE-2025-43359
BaseFortify
Publication date: 2025-09-15
Last updated on: 2026-04-02
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | ipados | to 18.7 (exc) |
| apple | iphone_os | to 18.7 (exc) |
| apple | macos | From 14.0 (inc) to 14.8 (exc) |
| apple | macos | From 15.0 (inc) to 15.7 (exc) |
| apple | tvos | to 26.0 (exc) |
| apple | visionos | to 26.0 (exc) |
| apple | watchos | to 26.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-670 | The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a logic issue related to state management in certain Apple operating systems. Specifically, a UDP server socket that is intended to be bound to a local interface may incorrectly become bound to all network interfaces, potentially exposing the service beyond its intended scope.
How can this vulnerability impact me? :
If exploited, this vulnerability could cause a UDP server socket to be accessible on all network interfaces rather than just a local one. This may increase the attack surface by exposing services to unintended networks, potentially allowing unauthorized access or network-based attacks.
What immediate steps should I take to mitigate this vulnerability?
Apply the fixed software updates provided by Apple for affected operating systems, including tvOS 26, macOS Sonoma 14.8, macOS Sequoia 15.7, iOS 18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26, and iPadOS 26.