CVE-2025-46304 Overview
CVE-2025-46304 is a denial-of-service vulnerability affecting Apple operating systems across multiple device families. A malicious Human Interface Device (HID) can trigger an unexpected process crash on a target system. Apple addressed the issue through improved bounds checks in the affected code paths. The flaw is classified under [CWE-400] uncontrolled resource consumption and requires an adjacent-network attack vector with user interaction.
The vulnerability impacts iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple shipped fixes in iOS 18.7.5, iPadOS 18.7.5, iOS 26.2, iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2.
Critical Impact
A malicious HID device may cause an unexpected process crash on the targeted Apple device, resulting in availability loss.
Affected Products
- Apple iOS and iPadOS (versions prior to 18.7.5 and 26.2)
- Apple macOS Sequoia, Sonoma, and Tahoe (prior to 15.7.4, 14.8.4, and 26.2)
- Apple tvOS 26.2, visionOS 26.2, and watchOS 26.2 (prior versions)
Discovery Timeline
- 2026-02-11 - CVE-2025-46304 published to NVD
- 2026-04-02 - Last updated in NVD database
Technical Details for CVE-2025-46304
Vulnerability Analysis
The vulnerability resides in Apple's HID handling code path, which processes input reports from connected Human Interface Devices. Insufficient bounds checks allow a crafted HID device to send malformed report data. Processing the malformed data causes an unexpected termination of the handling process.
The flaw is mapped to [CWE-400], reflecting uncontrolled consumption or mishandling of input that disrupts system availability. Successful exploitation does not affect confidentiality or integrity. The impact is limited to availability of the targeted process or service.
User interaction is required, typically in the form of connecting or pairing the malicious HID device. The attacker must be within adjacent-network range, such as Bluetooth proximity. EPSS data indicates a very low probability of observed exploitation activity at this time.
Root Cause
The root cause is missing or insufficient validation of HID report fields before the data is consumed by downstream parsing routines. Without proper bounds enforcement, attacker-controlled values can drive the parser into an invalid state that terminates the process. Apple's advisory describes the remediation as improved bounds checks.
Attack Vector
An attacker presents a malicious HID device, such as a crafted Bluetooth keyboard, mouse, or controller, to the target. When the victim pairs or connects to the device, malformed HID reports are delivered to the handling process. The malformed data triggers the unchecked code path and crashes the process.
No verified public proof-of-concept code is available for CVE-2025-46304. Refer to the Apple Security Advisory 126347 for vendor technical details.
Detection Methods for CVE-2025-46304
Indicators of Compromise
- Repeated unexpected crashes of HID-related processes shortly after Bluetooth pairing or USB attachment events
- Crash reports referencing HID input parsing on iOS, iPadOS, macOS, tvOS, visionOS, or watchOS
- Pairing attempts from unknown Bluetooth peripherals in proximity to managed Apple devices
Detection Strategies
- Collect and inspect ips crash logs from macOS endpoints for repeated HID-related faults
- Monitor Mobile Device Management (MDM) telemetry for Bluetooth pairing events from unrecognized peripherals
- Correlate device crash events with adjacency of unmanaged Bluetooth devices in office or shared spaces
Monitoring Recommendations
- Forward Apple endpoint crash diagnostics to a centralized logging or SIEM platform for anomaly review
- Track OS build and version inventory through MDM to confirm patch coverage across the fleet
- Alert on Bluetooth pairing requests in sensitive environments where peripheral usage is restricted
How to Mitigate CVE-2025-46304
Immediate Actions Required
- Update all Apple devices to the fixed versions: iOS/iPadOS 18.7.5 or 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2
- Audit Bluetooth pairing policies and remove unknown or unused paired peripherals
- Restrict Bluetooth and external peripheral connectivity on high-value devices until patches are deployed
Patch Information
Apple has released patches addressed in the following advisories: Apple Security Advisory 126347, Apple Security Advisory 126349, and Apple Security Advisory 126350. The fix introduces improved bounds checks in the HID handling code path. Administrators should deploy these updates through MDM or allow user-initiated installation via Software Update.
Workarounds
- Disable Bluetooth on affected devices when not in active use to reduce adjacent-network exposure
- Avoid pairing with untrusted or unknown HID peripherals, especially in public or shared environments
- Enforce MDM configuration profiles that restrict allowed peripheral types where feasible
# Example: query macOS version to confirm patch level
sw_vers -productVersion
# Example: list paired Bluetooth devices on macOS
system_profiler SPBluetoothDataType | grep -A2 "Connected:"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
