CVE-2025-46303: Apple macOS/iOS HID Device DoS Vulnerability

CVE-2025-46303 Overview

CVE-2025-46303 is a memory bounds check vulnerability affecting Apple macOS and iOS/iPadOS systems. The vulnerability exists in the handling of HID (Human Interface Device) input, where improper bounds checking can be exploited by a malicious HID device to cause an unexpected process crash. This represents a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerability that could result in denial of service conditions.

Critical Impact

A malicious HID device connected to an affected Apple device may trigger an unexpected process crash, potentially disrupting normal system operations and user workflows.

Affected Products

• macOS Sequoia prior to version 15.7.4
• macOS Sonoma prior to version 14.8.4
• iOS and iPadOS prior to version 18.7.5

Discovery Timeline

• 2026-02-11 - CVE-2025-46303 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-46303

Vulnerability Analysis

This vulnerability stems from improper bounds checking in Apple's HID subsystem. When a malicious HID device sends specially crafted input data, the system fails to properly validate the boundaries of data being processed, leading to memory operations that exceed expected bounds. This memory corruption issue (CWE-119) can cause process instability and unexpected crashes.

The attack requires local access and user interaction, meaning an attacker would need physical proximity to connect a malicious USB or Bluetooth HID device to the target system. While the vulnerability does not compromise confidentiality or integrity, it poses a significant availability risk by enabling denial of service through process crashes.

Root Cause

The root cause is insufficient bounds validation in the HID input processing routines. When processing descriptor data or input reports from HID devices, the affected code paths did not adequately verify that data lengths and offsets remained within acceptable memory boundaries before performing read or write operations.

Attack Vector

The attack vector requires local access with a malicious HID device. An attacker could craft a USB or Bluetooth device that identifies as a legitimate HID peripheral (keyboard, mouse, or other input device) but sends malformed descriptor or report data designed to trigger the bounds check failure.

When the malicious device is connected and the user interacts with the system, the crafted input data is processed by the HID subsystem. The improper bounds checking allows the malformed data to cause memory corruption, resulting in a process crash.

The vulnerability mechanism involves sending HID reports with manipulated size fields or descriptor data that causes the parsing routines to access memory outside of allocated buffers. For technical details, refer to the Apple Security Advisory for macOS Sequoia 15.7.4.

Detection Methods for CVE-2025-46303

Indicators of Compromise

• Unexpected system process crashes when USB or Bluetooth HID devices are connected
• Crash logs showing memory access violations in HID-related kernel extensions or user-space components
• Repeated connection attempts from unknown HID device identifiers

Detection Strategies

• Monitor system logs for crash reports involving IOHIDFamily, IOKit, or related HID processing components
• Implement endpoint detection rules to flag unusual HID device enumeration patterns
• Deploy USB device monitoring solutions to detect unrecognized or suspicious HID peripherals

Monitoring Recommendations

• Enable verbose logging for USB and Bluetooth device connections on critical systems
• Configure SentinelOne agents to monitor for crash patterns associated with HID subsystem failures
• Implement USB device whitelisting policies to prevent unauthorized HID devices from being enumerated

How to Mitigate CVE-2025-46303

Immediate Actions Required

• Update all affected macOS systems to Sequoia 15.7.4 or Sonoma 14.8.4 immediately
• Update iOS and iPadOS devices to version 18.7.5 or later
• Restrict physical access to systems and implement USB port security policies
• Educate users about the risks of connecting unknown USB devices

Patch Information

Apple has addressed this vulnerability with improved bounds checks in the following releases:

• macOS Sequoia 15.7.4 - See Apple Support Article #126347
• macOS Sonoma 14.8.4 - See Apple Support Article #126349
• iOS 18.7.5 and iPadOS 18.7.5 - See Apple Support Article #126350

Organizations should prioritize applying these updates through standard patch management processes.

Workarounds

• Implement USB device control policies to block unauthorized HID devices
• Disable USB ports on systems where external input devices are not required
• Use endpoint protection solutions with USB device monitoring capabilities to detect and block suspicious peripherals

# macOS: Check current system version
sw_vers -productVersion

# macOS: List connected USB devices for audit
system_profiler SPUSBDataType

# iOS/iPadOS: Navigate to Settings > General > About to verify version