CVE-2025-43337: Buffer Overflow
Published Sep 15, 2025
·Updated
Admin Framework. A logic issue was addressed with improved checks.
Other sources
AirPort. A permissions issue was addressed with additional restrictions.
— Apple
AMD. A buffer overflow was addressed with improved bounds checking.
— Apple
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26. An app may be able to access sensitive user data.
— MITRE
AppKit. The issue was resolved by blocking unsigned services from launching on Intel Macs.
— Apple
Apple Neural Engine. An out-of-bounds access issue was addressed with improved bounds checking.
— Apple
Credit
Ryan Dowd@@_rdowd, Csaba Fitzl@@theevilbit(Kandji), Nolan Astrein(Kandji), Mickey Jin@@patch1t, Gergely Kalman@@gergely_kalman, an anonymous researcher, Joseph Ravichandran@@0xjprx(MIT CSAIL), Dave G. (supernetworks.org), JZ, Zhongcheng Li(IES Red Team of ByteDance), Michael Reeves@@IntegralPilot, Duy Trần@@khanhduytran0, Morris Richman@@morrisinlife, Hikerell (Loadshine Lab), 이동하 (Lee Dong Ha(BoB 14th), wac(Trend Micro Zero Day Initiative), Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Adwiteeya Agrawal, Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), pattern-f@@pattern_F_, Ferdous Saljooki@@malwarezoo(Jamf), Murray Mike, Cristian Dinca (icmd.tech), Apple, Dave G.(supernetworks), Alex Radocea(supernetworks), Romain Lebesle(Khatima), Himanshu Bharti@@Xpl0itme(Khatima), Taavi Eomäe(Zone Media), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), BynarIO AI (bynar.io), Kirin@@Pwnrin, Atul R V, Asaf Cohen, CVE-2024-43398, CVE-2024-49761, CVE-2025-6442, Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir, Nikolai Skliarenko(Trend Micro Zero Day Initiative), Kirin@@Pwnrin(Microsoft), Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Wang Yu(Cyberserval), ABC Research s.r.o., Mickey Jin@@patch1t(Cisco Talos), Kirin@@Pwnrin(Cisco Talos), Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Zhongquan Li@@Guluisacat, Bilal Siddiqui, Noah Gregory (wts.dev), Dawuge(Shuffle Team), Rosyna Keller(Totally Not Malicious Software), Guilherme Rambo(Best Buddy Apps), Yinyi Wu@@_3ndy1(Dawn Security Lab of JD), @@zlluny(Trend Micro Zero Day Initiative), 이동하 (Lee Dong Ha)(SSA Lab), Matej Moravec@@MacejkoMoravec, Shantanu Thakur, Anonymous(Trend Micro Zero Day Initiative), Jian Lee@@speedyfriend433, Yiğit Can YILMAZ@@yilmazcanyigit, Keisuke Hosoda, Ye Zhang@@VAR10CK(Baidu Security), Viktor Oreshkin, Nathaniel Oh@@calysteon, Rodolphe Brunetti@@eisw0lf(Lupus Nova), LFY@@secsys(Fudan University), CVE-2025-40909, @@zlluny, CVE-2024-27280, KPC(Cisco Talos), @@RenwaX23, Ye Zhang(Baidu Security), 정답이 아닌 해답, Kirin@@Pwnrin(Computer Science), Cristian Dinca(Computer Science), Romania, CVE-2025-6965, Seo Hyun-gyu@@wh1te4ever, Luke Roberts@@rookuu, Justin Elliot Fu, Pyrophoria(GrapheneOS), an anonymous researcher(GrapheneOS), James J Kalafus, Michel Migdal, ken super, Jaydev Ahire, Big Bear, Ignacio Sanmillan@@ulexec, Mike Cardwell(grepular), Bob Lord, Pawel Wylecial(REDTEAM)
Affected Software
3 affected componentsFixes available
Apple macOS Tahoe<26
26
Apple macOS<26.0
Apple macOS Sequoia<15.7.2
15.7.2
Event History
Sep 15, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
Description
CVE Published
via MITRE·10:34 PM
Data Sourced
via MITRE·10:34 PM
DescriptionWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
Nov 3, 2025
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2025-43322
- CVE-2025-43337
- CVE-2025-43390
- CVE-2025-43468
- CVE-2025-43379
- CVE-2025-43469
- CVE-2025-43378
- CVE-2025-43478
- CVE-2025-43407
- CVE-2025-43446
- CVE-2025-43361
- CVE-2025-43423
- CVE-2025-43472
- CVE-2025-43394
- CVE-2025-43448
- CVE-2025-43395
- CVE-2025-43401
- CVE-2025-43292
- CVE-2025-43479
- CVE-2025-43382
- CVE-2025-43445
- CVE-2025-43481
- CVE-2025-43387
- CVE-2025-43420
- CVE-2025-43498
- CVE-2025-43348
- CVE-2025-43474
- CVE-2025-43396
- CVE-2025-43398
- CVE-2025-43510
- CVE-2025-43520
- CVE-2025-43413
- CVE-2025-43496
- CVE-2025-43494
- CVE-2025-43383
- CVE-2025-43385
- CVE-2025-43384
- CVE-2025-43377
- CVE-2025-43389
- CVE-2025-43410
- CVE-2025-43411
- CVE-2025-43405
- CVE-2025-43391
- CVE-2024-43398
- CVE-2024-49761
- CVE-2025-6442
- CVE-2025-43335
- CVE-2025-43408
- CVE-2025-43476
- CVE-2025-30465
- CVE-2025-43414
- CVE-2025-43499
- CVE-2025-43380
- CVE-2025-43477
- CVE-2025-43399
- CVE-2025-43336
- CVE-2025-43397
- CVE-2025-43409
- CVE-2025-43334
- CVE-2025-43412
- CVE-2025-43373
- CVE-2025-43288
- CVE-2025-43208
- CVE-2025-43312
- CVE-2025-43321
- CVE-2025-43344
- CVE-2025-31268
- CVE-2025-43331
- CVE-2025-43317
- CVE-2025-43340
- CVE-2025-43320
- CVE-2025-43285
- CVE-2025-43330
- CVE-2025-43346
- CVE-2025-43451
- CVE-2025-43307
- CVE-2025-43354
- CVE-2025-43303
- CVE-2025-43357
- CVE-2025-43323
- CVE-2025-43403
- CVE-2025-43349
- CVE-2025-43372
- CVE-2025-24088
- CVE-2025-43305
- CVE-2025-43290
- CVE-2025-43289
- CVE-2025-46284
- CVE-2025-43316
- CVE-2025-31271
- CVE-2025-31270
- CVE-2025-43326
- CVE-2025-43283
- CVE-2025-46280
- CVE-2025-43325
- CVE-2025-43287
- CVE-2025-43338
- CVE-2025-43302
- CVE-2025-31255
- CVE-2025-43366
- CVE-2025-43359
- CVE-2025-43345
- CVE-2025-43299
- CVE-2025-43295
- CVE-2025-43353
- CVE-2025-43294
- CVE-2025-43319
- CVE-2025-43315
- CVE-2025-43355
- CVE-2025-43207
- CVE-2025-43279
- CVE-2025-43301
- CVE-2025-43298
- CVE-2025-46310
- CVE-2025-40909
- CVE-2025-43297
- CVE-2025-31269
- CVE-2025-43204
- CVE-2024-27280
- CVE-2025-46306
- CVE-2025-43327
- CVE-2025-43329
- CVE-2025-43328
- CVE-2025-43318
- CVE-2025-46307
- CVE-2025-31259
- CVE-2025-43332
- CVE-2025-43293
- CVE-2025-43291
- CVE-2025-43286
- CVE-2025-43369
- CVE-2025-43358
- CVE-2025-43367
- CVE-2025-43190
- CVE-2025-43333
- CVE-2025-24197
- CVE-2025-6965
- CVE-2025-43341
- CVE-2025-43314
- CVE-2025-43304
- CVE-2025-43306
- CVE-2025-43347
- CVE-2025-43296
- CVE-2025-43311
- CVE-2025-43308
- CVE-2025-43262
- CVE-2025-43356
- CVE-2025-43272
- CVE-2025-43343
- CVE-2025-43342
- CVE-2025-43419
- CVE-2025-43376
- CVE-2025-43368
- CVE-2025-43310
Frequently Asked Questions
1
What is the severity of CVE-2025-43337?
CVE-2025-43337 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2025-43337?
To resolve CVE-2025-43337, update to macOS Tahoe 26 or later.
3
What type of issue is addressed in CVE-2025-43337?
CVE-2025-43337 addresses a permissions issue, a buffer overflow vulnerability, and an access issue.
4
What applications are affected by CVE-2025-43337?
CVE-2025-43337 may affect applications running on macOS Tahoe versions prior to 26.
5
What could potentially be accessed due to CVE-2025-43337?
CVE-2025-43337 could allow an app to access sensitive user data.