CVE-2025-46304: Apple iPadOS Denial of Service Vulnerability

CVE-2025-46304 Overview

CVE-2025-46304 is a denial-of-service vulnerability affecting Apple operating systems across multiple device families. A malicious Human Interface Device (HID) can trigger an unexpected process crash on a target system. Apple addressed the issue through improved bounds checks in the affected code paths. The flaw is classified under [CWE-400] uncontrolled resource consumption and requires an adjacent-network attack vector with user interaction.

The vulnerability impacts iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple shipped fixes in iOS 18.7.5, iPadOS 18.7.5, iOS 26.2, iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2.

Critical Impact
A malicious HID device may cause an unexpected process crash on the targeted Apple device, resulting in availability loss.

Affected Products

Apple iOS and iPadOS (versions prior to 18.7.5 and 26.2)
Apple macOS Sequoia, Sonoma, and Tahoe (prior to 15.7.4, 14.8.4, and 26.2)
Apple tvOS 26.2, visionOS 26.2, and watchOS 26.2 (prior versions)

Discovery Timeline

2026-02-11 - CVE-2025-46304 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2025-46304

Vulnerability Analysis

The vulnerability resides in Apple's HID handling code path, which processes input reports from connected Human Interface Devices. Insufficient bounds checks allow a crafted HID device to send malformed report data. Processing the malformed data causes an unexpected termination of the handling process.

The flaw is mapped to [CWE-400], reflecting uncontrolled consumption or mishandling of input that disrupts system availability. Successful exploitation does not affect confidentiality or integrity. The impact is limited to availability of the targeted process or service.

User interaction is required, typically in the form of connecting or pairing the malicious HID device. The attacker must be within adjacent-network range, such as Bluetooth proximity. EPSS data indicates a very low probability of observed exploitation activity at this time.

Root Cause

The root cause is missing or insufficient validation of HID report fields before the data is consumed by downstream parsing routines. Without proper bounds enforcement, attacker-controlled values can drive the parser into an invalid state that terminates the process. Apple's advisory describes the remediation as improved bounds checks.

Attack Vector

An attacker presents a malicious HID device, such as a crafted Bluetooth keyboard, mouse, or controller, to the target. When the victim pairs or connects to the device, malformed HID reports are delivered to the handling process. The malformed data triggers the unchecked code path and crashes the process.

No verified public proof-of-concept code is available for CVE-2025-46304. Refer to the Apple Security Advisory 126347 for vendor technical details.

Detection Methods for CVE-2025-46304

Indicators of Compromise

Repeated unexpected crashes of HID-related processes shortly after Bluetooth pairing or USB attachment events
Crash reports referencing HID input parsing on iOS, iPadOS, macOS, tvOS, visionOS, or watchOS
Pairing attempts from unknown Bluetooth peripherals in proximity to managed Apple devices

Detection Strategies

Collect and inspect ips crash logs from macOS endpoints for repeated HID-related faults
Monitor Mobile Device Management (MDM) telemetry for Bluetooth pairing events from unrecognized peripherals
Correlate device crash events with adjacency of unmanaged Bluetooth devices in office or shared spaces

Monitoring Recommendations

Forward Apple endpoint crash diagnostics to a centralized logging or SIEM platform for anomaly review
Track OS build and version inventory through MDM to confirm patch coverage across the fleet
Alert on Bluetooth pairing requests in sensitive environments where peripheral usage is restricted

How to Mitigate CVE-2025-46304

Immediate Actions Required

Update all Apple devices to the fixed versions: iOS/iPadOS 18.7.5 or 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2
Audit Bluetooth pairing policies and remove unknown or unused paired peripherals
Restrict Bluetooth and external peripheral connectivity on high-value devices until patches are deployed

Patch Information

Apple has released patches addressed in the following advisories: Apple Security Advisory 126347, Apple Security Advisory 126349, and Apple Security Advisory 126350. The fix introduces improved bounds checks in the HID handling code path. Administrators should deploy these updates through MDM or allow user-initiated installation via Software Update.

Workarounds

Disable Bluetooth on affected devices when not in active use to reduce adjacent-network exposure
Avoid pairing with untrusted or unknown HID peripherals, especially in public or shared environments
Enforce MDM configuration profiles that restrict allowed peripheral types where feasible

bash

# Example: query macOS version to confirm patch level
sw_vers -productVersion

# Example: list paired Bluetooth devices on macOS
system_profiler SPBluetoothDataType | grep -A2 "Connected:"