CVE-2025-43361: Apple iPadOS Information Disclosure Flaw

CVE-2025-43361 Overview

CVE-2025-43361 is an out-of-bounds read vulnerability affecting multiple Apple operating systems. A malicious application installed on an affected device can read kernel memory, exposing sensitive data that should remain isolated from user-space processes. Apple addressed the issue with improved bounds checking across its product portfolio.

The flaw is categorized under [CWE-125] (Out-of-bounds Read) and requires local access with low privileges. Successful exploitation compromises the confidentiality of kernel memory contents, which frequently contain cryptographic material, pointers useful for defeating Kernel Address Space Layout Randomization (KASLR), and other sensitive kernel state.

Critical Impact
A malicious app installed locally can read kernel memory on iOS, iPadOS, macOS, tvOS, visionOS, and watchOS devices, enabling information disclosure that can facilitate follow-on kernel exploitation.

Affected Products

Apple iOS and iPadOS (fixed in iOS 26 and iPadOS 26)
Apple macOS (fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and macOS Tahoe 26)
Apple tvOS 26, visionOS 26, and watchOS 26

Discovery Timeline

2025-11-04 - CVE-2025-43361 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43361

Vulnerability Analysis

The vulnerability is an out-of-bounds read in an Apple operating system component that services requests from user-space applications. When a malicious app supplies crafted input, the affected code path reads memory beyond the intended buffer boundary and returns that data across the user/kernel boundary.

Because the disclosed memory resides in the kernel address space, an attacker can harvest pointers, credentials, tokens, and other sensitive state. This information is commonly chained with a separate memory-corruption primitive to bypass mitigations such as KASLR and Pointer Authentication Codes (PAC), transforming an information leak into full kernel compromise.

Apple has not published component-level technical details. Refer to the Apple Security Update 125108 and related advisories for the specific subsystem affected on each platform.

Root Cause

The root cause is missing or insufficient bounds checking on a buffer accessed by the kernel. When the code processes attacker-influenced length or index values, it reads past the end of the allocated region. Apple's fix note states the issue was addressed with improved bounds checking, consistent with adding validation on offsets, sizes, or index computations prior to the read.

Attack Vector

Exploitation requires local code execution on the target device, delivered through a malicious application. No user interaction is required beyond installing and running the app. The attacker must already possess low-privilege execution, such as a sandboxed third-party application. Because the impact is confined to information disclosure at the kernel boundary, the vulnerability is most valuable as a component in a larger exploit chain rather than a standalone attack.

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation is currently associated with CVE-2025-43361, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-43361

Indicators of Compromise

No public indicators of compromise have been published for CVE-2025-43361.
Presence of unsigned, sideloaded, or recently installed applications from untrusted sources on devices running pre-patch OS versions.
Applications requesting entitlements or making unusual syscall volume that deviates from a documented baseline.

Detection Strategies

Inventory managed Apple devices and identify those running OS versions prior to iOS 26, iPadOS 26, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26, or watchOS 26.
Correlate application install events with subsequent kernel panics, unexpected process terminations, or MDM compliance changes.
Review mobile threat defense telemetry for applications exhibiting anomalous IOKit or Mach trap invocation patterns.

Monitoring Recommendations

Enforce Mobile Device Management (MDM) policies that restrict installation of applications from outside the App Store or approved enterprise catalogs.
Monitor endpoint telemetry from macOS devices for newly executed unsigned binaries and correlate against the patched OS baseline.
Track Apple Security Update advisories and reconcile the software inventory after each release cycle.

How to Mitigate CVE-2025-43361

Immediate Actions Required

Update all affected Apple devices to iOS 26, iPadOS 26, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26, or watchOS 26.
Prioritize devices that permit sideloading, developer mode, or enterprise app distribution, as these expand the local attack surface.
Audit installed applications on unpatched devices and remove any that are untrusted or unnecessary.

Patch Information

Apple released fixes across its operating systems. Consult the vendor advisories for each platform: Apple Security Update 125108, Apple Security Update 125114, Apple Security Update 125115, Apple Security Update 125116, Apple Security Update 125635, and Apple Security Update 125636. Deploy patches through MDM where possible to ensure compliance across managed fleets.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation.
Restrict application installation to vetted sources by enforcing App Store or managed distribution policies via MDM.
Disable developer mode and sideloading on production devices until updates are applied.

bash

# Verify macOS build version against the patched release
sw_vers -productVersion

# Example MDM query to identify unpatched iOS/iPadOS devices
# (issued through your MDM's device query API)
# Target: OSVersion < 26