CVE-2025-43510

What it actually does

CVE-2025-43510 is a memory-corruption vulnerability in Apple operating systems caused by improper lock-state handling around memory shared between processes. A malicious local application can trigger unexpected changes in shared memory, potentially compromising confidentiality, integrity, and availability of data or processes on the device. The CVSS vector indicates local exploitation with low attack complexity, no prior privileges required, and user interaction required, with high impact across confidentiality, integrity, and availability.

Why it matters to the business

Successful exploitation can allow a malicious application to tamper with process memory, destabilize devices, expose sensitive information, or support broader compromise of Apple endpoints. Because this issue is listed in CISA KEV, has observed in-the-wild exploitation, and is associated with reported threat activity including DarkSword, organizations should treat affected Apple devices as a priority patching target even though the EPSS score is currently low. Operationally, unpatched iPhones, iPads, Macs, Apple TVs, Apple Vision Pro devices, and Apple Watches may remain exposed to malicious app-based exploitation until upgraded.

How an attack unfolds

An attacker first needs to get a malicious application onto an affected Apple device or convince a user to open or interact with attacker-controlled app content. The application then exercises vulnerable code paths that manage memory shared between processes while lock-state checks are incorrect or incomplete. By racing or manipulating shared-memory state, the attacker may cause memory corruption or unexpected memory changes across process boundaries. Depending on platform hardening, sandbox boundaries, and exploit chaining, this can lead to process compromise, data exposure, tampering with application behavior, or device instability. Because exploitation has been reported in the wild and the vulnerability is in CISA KEV, defenders should assume capable attackers may use this as part of a larger chain rather than as a standalone event.

How to fix it

Upgrade all affected Apple platforms to the fixed versions or later: iOS 18.7.2 or iOS 26.1, iPadOS 18.7.2 or iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1. Prioritize internet-facing, executive, administrator, developer, mobile workforce, and BYOD-managed devices where malicious app exposure is more likely. If immediate patching is not possible, restrict installation of untrusted applications, enforce MDM application allowlisting where feasible, disable sideloading or unmanaged app sources, require current OS baselines for access to corporate resources, and increase monitoring for suspicious app crashes, unusual privacy permission use, and abnormal endpoint behavior. CISA KEV remediation deadline is 2026-04-03; organizations subject to KEV requirements should complete remediation by that date or sooner.

How to confirm the fix worked

Confirm that devices report fixed or later OS versions through MDM inventory, endpoint management, or local system checks. Validate iOS/iPadOS devices are on 18.7.2, 26.1, or later; macOS Sequoia devices are on 15.7.2 or later; macOS Sonoma devices are on 14.8.2 or later; macOS Tahoe devices are on 26.1 or later; and tvOS, visionOS, and watchOS devices are on 26.1 or later. Cross-check that compliance policies block or quarantine devices below the fixed baselines. For macOS, confirm version with `sw_vers`; for managed Apple mobile devices, confirm OS build/version from MDM inventory. Review patch deployment reports for failed, deferred, or unmanaged devices, and perform spot checks on high-risk user groups.

Typical attack path

1. Identify a target using an affected Apple OS version: iOS/iPadOS before 18.7.2 or 26.1, macOS Sequoia before 15.7.2, macOS Sonoma before 14.8.2, macOS Tahoe before 26.1, tvOS before 26.1, visionOS before 26.1, or watchOS before 26.1.
2. Deliver or induce installation/execution of a malicious application or app-delivered content requiring user interaction.
3. Trigger the vulnerable shared-memory locking condition from local app context.
4. Cause unexpected memory changes across process boundaries through memory corruption.
5. Use the resulting corruption to disclose data, alter process behavior, crash services, or chain with additional vulnerabilities for broader compromise.
6. Maintain access or continue post-exploitation activity through other mechanisms if the exploit chain succeeds.

How to detect it

There are no public, vulnerability-specific file names, process names, network signatures, or log strings that reliably identify exploitation of this issue. Detection should focus on behavioral and forensic evidence around the time a suspicious app was installed or executed. Review MDM inventory for affected OS versions, app install history, configuration profile changes, and devices with delayed or failed updates. On macOS, collect unified logs, crash reports, EndpointSecurity/EDR telemetry, quarantine events, Gatekeeper/XProtect events, and application execution history. On iOS, iPadOS, visionOS, tvOS, and watchOS, use MDM, Apple device analytics, crash diagnostics, and mobile threat defense telemetry where available. Look for repeated crashes in system or application processes, crashes involving memory corruption symptoms, unexpected restarts or resprings, newly installed uncommon applications shortly before crashes, unusual privacy permission prompts or grants, abnormal interprocess activity where visible to EDR, and follow-on behaviors such as credential access, suspicious network connections, persistence attempts, or configuration tampering. Because reported exploitation is active in the wild and associated threat context includes DarkSword, suspicious findings on unpatched devices should be investigated as potential exploit-chain activity rather than dismissed as ordinary application instability.

What your security team should do

• Treat this as a high-priority Apple fleet patching issue because it is in CISA KEV and has active in-the-wild exploitation despite a low EPSS score.
• Deploy the fixed Apple OS versions or later across all affected device classes and enforce minimum OS versions through MDM or access control.
• Identify unmanaged or stale Apple devices and either bring them under management, isolate them from sensitive services, or block access until remediated.
• Restrict installation of unknown, unsigned, sideloaded, or non-business applications where organizational policy allows.
• Review recent endpoint telemetry for suspicious application crashes, repeated memory-corruption crash reports, unusual app behavior, and new or rarely seen applications installed shortly before crashes.
• Increase scrutiny of users or device populations at elevated risk, including executives, administrators, developers, security staff, and users targeted by mobile threat campaigns.
• If suspicious exploitation is suspected, preserve crash logs, unified logs, application install history, MDM inventory, and endpoint telemetry before wiping or reimaging devices.