CVE-2025-43384: Apple iPadOS Use After Free Vulnerability

CVE-2025-43384 Overview

CVE-2025-43384 is an out-of-bounds access vulnerability affecting multiple Apple operating systems, including iOS, iPadOS, macOS, tvOS, and visionOS. The flaw resides in Apple's media processing components and is triggered when a user opens or previews a maliciously crafted media file. Successful exploitation can cause unexpected application termination or corrupt process memory, potentially undermining the stability and integrity of running processes.

Apple addressed the issue through improved bounds checking in iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, and visionOS 26.1. The vulnerability is classified under [CWE-125] (Out-of-Bounds Read).

Critical Impact
Processing a maliciously crafted media file can terminate the target application or corrupt process memory, which may affect availability of client-side workflows.

Affected Products

Apple iOS and iPadOS (prior to 18.7.2 and 26.1)
Apple macOS Sequoia (prior to 15.7.2) and macOS Tahoe (prior to 26.1)
Apple tvOS and visionOS (prior to 26.1)

Discovery Timeline

2025-11-04 - CVE-2025-43384 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43384

Vulnerability Analysis

The vulnerability is an out-of-bounds access flaw in Apple's media file parsing code paths. When the affected code processes a malformed media container, it reads or accesses memory outside the intended buffer boundaries. The result is either an application crash or corruption of adjacent process memory structures.

The attack requires user interaction — the victim must open, preview, or otherwise process a crafted media file. No elevated privileges are required to trigger the flaw. While the primary impact is denial of service through application termination, memory corruption raises the possibility of secondary exploitation when chained with other primitives.

Root Cause

The root cause is missing or insufficient bounds validation during media file parsing. Apple's fix explicitly cites "improved bounds checking," indicating that specific size or offset fields within media inputs were consumed without proper validation against buffer limits. This pattern is consistent with [CWE-125] Out-of-Bounds Read.

Attack Vector

Attackers deliver the crafted media file through common channels such as email attachments, messaging applications, websites, or shared storage. When the victim's application invokes the vulnerable media handling code to render, decode, or generate a preview, the malformed structure triggers the out-of-bounds access. Because the flaw is network-reachable and requires only user interaction, phishing and drive-by delivery are realistic exploitation paths.

No verified proof-of-concept code is publicly available. Refer to the Apple Security Advisory #125632 and related advisories for vendor technical details.

Detection Methods for CVE-2025-43384

Indicators of Compromise

Unexpected termination or repeated crash reports from media handling applications such as Preview, QuickTime, or messaging clients rendering attachments.
Diagnostic reports in ~/Library/Logs/DiagnosticReports/ referencing media framework libraries and out-of-bounds memory access.
Delivery of unsolicited media files through email, iMessage, or web downloads to endpoints running unpatched Apple OS versions.

Detection Strategies

Inventory Apple endpoints and compare installed OS versions against the fixed builds (iOS/iPadOS 18.7.2 or 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1).
Alert on abnormal crash frequency for media-processing processes across managed Apple devices.
Inspect email and web gateways for anomalous media file structures targeting Apple clients.

Monitoring Recommendations

Forward macOS ReportCrash and mobile device management (MDM) crash telemetry to a centralized log platform for correlation.
Track patch compliance rates for iOS, iPadOS, macOS, tvOS, and visionOS fleets on an ongoing basis.
Monitor endpoints for post-crash behavior such as new process launches or outbound connections that could indicate secondary exploitation attempts.

How to Mitigate CVE-2025-43384

Immediate Actions Required

Apply Apple's security updates: iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, and visionOS 26.1.
Prioritize patch deployment for devices that regularly process untrusted media, such as executive and communications endpoints.
Educate users to avoid opening unexpected media attachments from untrusted senders until updates are applied.

Patch Information

Apple documents the fix across multiple advisories. Review the relevant advisory for each platform: Apple Security Advisory #125632, Apple Security Advisory #125633, Apple Security Advisory #125634, Apple Security Advisory #125635, Apple Security Advisory #125637, and Apple Security Advisory #125638.

Workarounds

Restrict automatic media previews in email and messaging applications on unpatched devices.
Use MDM policies to block untrusted media file types at the endpoint or gateway until patches are deployed.
Isolate legacy or unmanaged Apple devices that cannot be updated to the fixed OS versions.

bash

# Verify current macOS version and confirm patch level
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate -l
sudo softwareupdate -ia --restart