CVE-2025-46301: Apple iPadOS Denial of Service Vulnerability

CVE-2025-46301 Overview

CVE-2025-46301 is an out-of-bounds memory access vulnerability [CWE-119] affecting Apple's Human Interface Device (HID) handling across multiple operating systems. A malicious HID device connected over an adjacent network interface can cause an unexpected process crash on the target system. Apple addressed the issue with improved bounds checks in iOS 18.7.5, iPadOS 18.7.5, iOS 26.2, iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2.

The vulnerability requires user interaction and adjacent network access, which limits remote exploitation. The impact is restricted to availability, with no confidentiality or integrity loss.

Critical Impact
A malicious HID device may trigger an unexpected process crash, resulting in denial of service on affected Apple platforms.

Affected Products

Apple iOS and iPadOS (versions prior to 18.7.5 and 26.2)
Apple macOS Sequoia, Sonoma, and Tahoe (prior to 15.7.4, 14.8.4, and 26.2)
Apple tvOS, visionOS, and watchOS (prior to 26.2)

Discovery Timeline

2026-02-11 - CVE-2025-46301 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2025-46301

Vulnerability Analysis

The vulnerability resides in Apple's HID processing subsystem, which handles input from devices such as keyboards, mice, game controllers, and other peripherals. When the operating system parses descriptors or reports from a connected HID device, insufficient bounds checking allows malformed data to access memory outside intended buffers. This out-of-bounds condition results in an unexpected process crash rather than memory corruption that could enable code execution.

An attacker must present a maliciously crafted HID device to the target system. The adjacent network attack vector indicates the HID can be presented over a protocol such as Bluetooth, which operates within radio range of the victim device. User interaction is required, meaning the victim must accept the pairing or connection prompt before the malicious payload can be delivered.

Root Cause

The defect stems from improper validation of length or offset values within HID input data structures. Apple's advisory states that the fix involved "improved bounds checks," indicating the underlying code path failed to verify that incoming data lengths fell within allocated buffer boundaries. This class of flaw maps to [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Attack Vector

Exploitation requires an attacker within adjacent network range of the target. The attacker advertises or presents a HID device with malformed descriptors. Once the victim accepts the connection, the operating system parses the malicious data and the affected process crashes. Repeated exploitation can produce sustained denial of service against system services that handle peripheral input.

No verified public proof-of-concept code is available for this vulnerability. Refer to the Apple Security Update 126347, Apple Security Update 126349, and Apple Security Update 126350 advisories for vendor technical details.

Detection Methods for CVE-2025-46301

Indicators of Compromise

Unexpected crash reports referencing HID-related processes such as IOHIDFamily or hidd in macOS unified logs and crash report directories
Repeated Bluetooth or USB peripheral pairing attempts from unknown device identifiers within a short time window
System availability degradation correlated with the connection of unrecognized input devices

Detection Strategies

Monitor macOS crash logs under /Library/Logs/DiagnosticReports/ for recurring HID subsystem panics
Collect and analyze Bluetooth pairing events through endpoint telemetry to identify untrusted device advertisements
Correlate device-connection events with process termination signals on managed endpoints

Monitoring Recommendations

Ingest macOS endpoint telemetry into a centralized data lake to baseline normal HID device activity and flag anomalies
Alert on repeated process crashes affecting IOHIDFamily, WindowServer, or related input services
Track operating system version inventory to identify endpoints running pre-patch builds of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS

How to Mitigate CVE-2025-46301

Immediate Actions Required

Update affected devices to iOS 18.7.5, iPadOS 18.7.5, iOS 26.2, iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, or watchOS 26.2
Audit mobile device management (MDM) policies to enforce the latest Apple OS versions across the fleet
Educate users to reject pairing requests from unknown Bluetooth or HID devices

Patch Information

Apple released coordinated security updates addressing CVE-2025-46301 across its product line. Refer to Apple Security Update 126347, Apple Security Update 126349, Apple Security Update 126350, Apple Security Update 125884, Apple Security Update 125886, Apple Security Update 125889, Apple Security Update 125890, and Apple Security Update 125891 for version-specific details.

Workarounds

Disable Bluetooth on devices that do not require wireless peripherals to reduce the adjacent attack surface
Restrict physical and wireless access to managed endpoints in sensitive environments
Configure MDM policies to block pairing with unapproved peripheral classes where supported

bash

# Verify macOS version on managed endpoints
sw_vers -productVersion

# Disable Bluetooth via defaults (requires admin privileges)
sudo defaults write /Library/Preferences/com.apple.Bluetooth ControllerPowerState -int 0
sudo killall -HUP bluetoothd