CVE-2025-43424: Apple iPadOS HID Device DoS Vulnerability

CVE-2025-43424 Overview

CVE-2025-43424 is a memory safety issue in Apple's Human Interface Device (HID) handling across iOS, iPadOS, and macOS. A malicious HID device can trigger an unexpected process crash due to insufficient bounds checking. Apple addressed the issue with improved bounds checks in iOS 26.1, iPadOS 26.1, and macOS Tahoe 26.1.

The vulnerability is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Exploitation requires adjacency to the target, such as physical proximity or a shared local bus. No user interaction or authentication is required, and impact is limited to availability.

Critical Impact
A crafted HID device within adjacent range can crash a system process on unpatched Apple devices, causing a denial of service condition.

Affected Products

Apple iOS prior to 26.1
Apple iPadOS prior to 26.1
Apple macOS Tahoe prior to 26.1

Discovery Timeline

2025-11-04 - CVE-2025-43424 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43424

Vulnerability Analysis

The flaw resides in Apple's HID subsystem, which processes input from peripherals such as keyboards, mice, game controllers, and Bluetooth accessories. HID reports are parsed by system components that assume the incoming report descriptor and payload conform to expected sizes. When these assumptions fail, the parser accesses memory outside the intended buffer boundary.

Apple's advisory states the issue was resolved with improved bounds checks, indicating a boundary condition error in the HID parsing path. A malicious HID device supplying a malformed report descriptor or oversized report can drive the affected code into an out-of-bounds access, terminating the process handling the device.

The consequences are limited to availability. Confidentiality and integrity are not impacted per the CVSS vector, and the crash halts a process rather than yielding code execution.

Root Cause

The root cause is insufficient validation of length or offset fields in data received from an untrusted HID peripheral. The affected code path reads or writes memory relative to a buffer without confirming that the operation stays within allocated bounds, aligning with [CWE-119].

Attack Vector

Exploitation requires the attacker to present a malicious HID device to the target. This can occur over USB, Bluetooth, or another HID-capable transport reachable from the adjacent network. Once the target enumerates the device, the malformed HID report reaches the vulnerable parser and triggers the crash. No credentials or user interaction are needed.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-43424

Indicators of Compromise

Repeated unexpected crashes of HID-related system processes such as IOHIDFamily, hidd, or WindowServer shortly after a peripheral connection.
New crash reports under ~/Library/Logs/DiagnosticReports/ or /Library/Logs/DiagnosticReports/ referencing HID components.
Bluetooth or USB pairing events immediately preceding process termination or system instability.

Detection Strategies

Collect and monitor macOS unified logs for HID subsystem faults and correlate with device enumeration events.
Track OS build and version telemetry to identify endpoints still running iOS, iPadOS, or macOS versions below 26.1.
Alert on repeated USB or Bluetooth HID device connections from unknown vendor and product identifiers.

Monitoring Recommendations

Forward macOS crash reports and ReportCrash events to a centralized log platform for anomaly analysis.
Baseline expected HID peripherals per host and flag deviations, especially in high-value environments.
Review mobile device management (MDM) inventory data to confirm timely rollout of the 26.1 update series.

How to Mitigate CVE-2025-43424

Immediate Actions Required

Update all Apple endpoints to iOS 26.1, iPadOS 26.1, or macOS Tahoe 26.1 or later.
Enforce the update through MDM policies and confirm compliance with fleet reporting.
Restrict use of untrusted USB and Bluetooth peripherals on affected devices until patched.

Patch Information

Apple released fixes in iOS 26.1, iPadOS 26.1, and macOS Tahoe 26.1. Details are documented in the Apple Support Document #125632 and the Apple Support Document #125634.

Workarounds

Disable Bluetooth on affected devices in environments where pairing cannot be controlled.
Block unapproved USB HID devices using endpoint device control policies.
Physically secure devices to prevent an attacker from attaching a malicious HID peripheral.

bash

# Verify current macOS version on a managed endpoint
sw_vers -productVersion

# Confirm the device meets or exceeds the fixed version
# Expected output: 26.1 or later