CVE-2025-46304

Modified Modified - Updated After Analysis

Bounds Check Vulnerability in Apple HID Driver Causes Process Crash

Publication date: 2026-02-11

Last updated on: 2026-04-02

Assigner: Apple Inc.

Description

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-11

Last Modified

2026-04-02

Generated

2026-07-06

AI Q&A

2026-02-12

EPSS Evaluated

2026-07-05

NVD

CVE-2025-46304

EUVD

EUVD-2025-206965

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 18.7.5 (exc)
apple	iphone_os	to 18.7.5 (exc)
apple	macos	From 15.0 (inc) to 15.7.4 (exc)
apple	macos	From 14.0 (inc) to 14.8.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in the handling of input from malicious Human Interface Devices (HID). Specifically, a malicious HID device can cause an unexpected process crash due to insufficient bounds checks in the affected Apple operating systems.

The issue was addressed by improving bounds checks in the affected systems, which include macOS Sequoia 15.7.4, iOS 18.7.5, iPadOS 18.7.5, and macOS Sonoma 14.8.4.

Impact Analysis

This vulnerability can impact you by allowing a malicious HID device to cause an unexpected process crash on your device. Such crashes can lead to denial of service or instability in the affected system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update your Apple devices to the fixed versions: macOS Sequoia 15.7.4, iOS 18.7.5, iPadOS 18.7.5, or macOS Sonoma 14.8.4.

Avoid connecting untrusted or unknown HID devices to your system to prevent potential malicious input that could cause unexpected process crashes.

Hi! I’m here to help you understand CVE-2025-46304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70