CVE-2025-46301: Apple macOS/iOS HID DoS Vulnerability

CVE-2025-46301 Overview

CVE-2025-46301 is a memory corruption vulnerability in Apple's macOS and iOS operating systems caused by improper bounds checks when handling Human Interface Device (HID) data. The vulnerability allows a malicious HID device to trigger an unexpected process crash, resulting in a denial of service condition. This weakness is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact

A physically connected malicious HID device can cause system process crashes, potentially disrupting user workflows and system availability.

Affected Products

• macOS Sequoia (versions prior to 15.7.4)
• macOS Sonoma (versions prior to 14.8.4)
• iOS 18.7.5 and iPadOS 18.7.5 (versions prior to 18.7.5)

Discovery Timeline

• 2026-02-11 - CVE-2025-46301 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-46301

Vulnerability Analysis

This vulnerability exists within Apple's HID subsystem, which is responsible for processing input from external devices such as keyboards, mice, game controllers, and other USB or Bluetooth peripherals. The flaw stems from insufficient bounds checking when parsing HID descriptor data or input reports from connected devices.

When a malicious HID device sends specially crafted data that exceeds expected buffer boundaries, the system fails to properly validate the data length before processing. This leads to out-of-bounds memory access operations that corrupt memory structures used by the HID processing routines.

The attack requires local physical access to connect a malicious device, limiting the attack surface to scenarios where an adversary has direct access to the target system's USB ports or can establish a Bluetooth connection. User interaction is required in the form of connecting or pairing the malicious device.

Root Cause

The root cause is a boundary condition error (CWE-119) in the HID device driver or framework code. The vulnerable code path fails to verify that incoming HID data fits within allocated buffer sizes before performing read or write operations. This improper restriction of operations within memory buffer bounds allows carefully crafted HID reports to trigger memory access violations.

Attack Vector

The attack requires physical access to the target device to connect a malicious HID peripheral. An attacker could create a custom USB device or modified commercial HID device that sends malformed descriptor data or input reports. When the victim connects this device to their Mac or iOS device, the HID subsystem processes the malicious data without adequate bounds validation, causing memory corruption that results in a process crash.

The vulnerability does not require authentication or elevated privileges to exploit, though it does require the user to physically connect or pair the malicious device. Successful exploitation results in denial of service through process termination but does not appear to enable code execution or data exfiltration based on available information.

Detection Methods for CVE-2025-46301

Indicators of Compromise

• Unexpected system process crashes or kernel panics occurring shortly after connecting new HID devices
• Crash reports in Console.app or /Library/Logs/DiagnosticReports referencing HID-related processes or kernel extensions
• Unusual USB device connection events in system logs with unrecognized vendor or product IDs

Detection Strategies

• Monitor system logs for HID subsystem crashes using log show --predicate 'subsystem == "com.apple.iokit.hid"'
• Implement USB device allow-listing to detect unauthorized HID device connections
• Deploy endpoint detection solutions capable of monitoring for anomalous device enumeration patterns
• Review crash reports for memory corruption signatures in HID-related code paths

Monitoring Recommendations

• Enable enhanced logging for USB device connections and disconnections
• Configure alerts for repeated process crashes in HID-related system services
• Monitor for USB devices with unusual descriptor configurations or malformed data
• Implement SentinelOne endpoint protection to detect exploitation attempts targeting HID vulnerabilities

How to Mitigate CVE-2025-46301

Immediate Actions Required

• Update macOS Sequoia to version 15.7.4 or later
• Update macOS Sonoma to version 14.8.4 or later
• Update iOS and iPadOS to version 18.7.5 or later
• Restrict physical access to systems to trusted personnel only
• Disable unused USB ports in high-security environments

Patch Information

Apple has addressed this vulnerability with improved bounds checks in the affected operating systems. Security updates are available through the following advisories:

• Apple Security Advisory 126347 - macOS Sequoia 15.7.4
• Apple Security Advisory 126349 - iOS 18.7.5 and iPadOS 18.7.5
• Apple Security Advisory 126350 - macOS Sonoma 14.8.4

Apply these updates immediately through System Settings > General > Software Update on macOS or Settings > General > Software Update on iOS/iPadOS.

Workarounds

• Implement strict physical security controls to prevent unauthorized device connections
• Use USB port blockers or disable USB ports via MDM policies where feasible
• Configure device management profiles to restrict HID device pairing on managed devices
• Avoid connecting unknown or untrusted USB devices to sensitive systems

# Check current macOS version to verify patch status
sw_vers -productVersion

# List connected HID devices for audit purposes
ioreg -p IOUSB -l | grep -E "(Product|Vendor|Serial)"

# Review system logs for HID-related crashes
log show --predicate 'eventMessage contains "HID"' --last 24h