CVE-2025-43376
BaseFortify
Publication date: 2025-11-04
Last updated on: 2026-04-02
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | safari | to 26.0 (exc) |
| apple | ipados | to 26.0 (exc) |
| apple | iphone_os | to 26.0 (exc) |
| apple | visionos | to 26.0 (exc) |
| apple | watchos | to 26.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a logic issue related to state management in Apple's software. It allows a remote attacker to potentially view leaked DNS queries even when Private Relay is turned on, which is supposed to protect user privacy.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow a remote attacker to see DNS queries that should be protected by Private Relay, potentially exposing information about the websites you visit and compromising your privacy.
What immediate steps should I take to mitigate this vulnerability?
Update affected Apple products to Safari 26, tvOS 26, watchOS 26, iOS 26, iPadOS 26, or visionOS 26 where this issue is fixed. Additionally, consider disabling Private Relay until the update is applied to prevent potential DNS query leakage.