BaseFortify

Publication date: 2025-11-12

Last updated on: 2026-04-02

Assigner: Apple Inc.

Description

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to bypass ASLR.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-12

Last Modified

2026-04-02

Generated

2026-07-06

AI Q&A

2025-11-12

EPSS Evaluated

2026-07-05

NVD

CVE-2025-43205

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 18.4 (exc)
apple	iphone_os	to 18.4 (exc)
apple	tvos	to 18.4 (exc)
apple	visionos	to 2.4 (exc)
apple	watchos	to 11.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds access issue that was addressed by improving bounds checking. It allows an app to potentially bypass Address Space Layout Randomization (ASLR), a security feature that helps prevent exploitation of memory corruption vulnerabilities.

Impact Analysis

If exploited, this vulnerability could allow a malicious app to bypass ASLR, potentially leading to unauthorized access or execution of arbitrary code, which could compromise the security of the affected device.

Mitigation Strategies

Update affected Apple operating systems to the fixed versions: watchOS 11.4, tvOS 18.4, visionOS 2.4, iOS 18.4, and iPadOS 18.4 to address the out-of-bounds access issue and prevent apps from bypassing ASLR.

Hi! I’m here to help you understand CVE-2025-43205. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70