CVE-2025-43407: Use After Free
Published Nov 3, 2025
·Updated
Accessibility. A permissions issue was addressed with additional restrictions.
Credit
Mickey Jin@@patch1t, Gergely Kalman@@gergely_kalman, Joseph Ravichandran@@0xjprx(MIT CSAIL), Dave G. (supernetworks.org), JZ, Zhongcheng Li(IES Red Team of ByteDance), Michael Reeves@@IntegralPilot, Morris Richman@@morrisinlife, Csaba Fitzl@@theevilbit(Kandji), Hikerell (Loadshine Lab), 이동하 (Lee Dong Ha(BoB 14th), wac(Trend Micro Zero Day Initiative), an anonymous researcher, Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), pattern-f@@pattern_F_, Ferdous Saljooki@@malwarezoo(Jamf), Murray Mike, 이동하 (Lee Dong Ha)(SSA Lab), Cristian Dinca (icmd.tech), Apple, Dave G.(supernetworks), Alex Radocea(supernetworks), Taavi Eomäe(Zone Media), Kirin@@Pwnrin, Atul R V, Asaf Cohen, CVE-2024-43398, CVE-2024-49761, CVE-2025-6442, Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir, Nikolai Skliarenko(Trend Micro Zero Day Initiative), Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Alexia Wilson(Microsoft), Christine Fossaceca(Microsoft), Wang Yu(Cyberserval), Ryan Dowd@@_rdowd, Nolan Astrein(Kandji), Duy Trần@@khanhduytran0, Adwiteeya Agrawal, Romain Lebesle(Khatima), Himanshu Bharti@@Xpl0itme(Khatima), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), BynarIO AI (bynar.io), Kirin@@Pwnrin(Microsoft), iisBuri, @@RenwaX23, Stanislav Jelezoglo, Aleksejs Popovs, Phil Beauvoir, Google Big Sleep, Gary Kwong, rheza@@ginggilBesel, Justin Cohen(Google), Nan Wang@@eternalsakura13, rheza@@ginggilBesel(Trend Micro Zero Day Initiative), shandikri(Trend Micro Zero Day Initiative), Gary Kwong(Trend Micro Zero Day Initiative), Tom Van Goethem, Ron Masas(BreakPoint), Pinak Oza, Wojciech Regula(SecuRing), Kirin@@Pwnrin(Fudan University), LFY@@secsys(Fudan University), Kenneth Chew, @@EthanArbuckle, Google Threat Analysis Group, Doug Hogan, KPC(Cisco Talos), Zhongquan Li@@Guluisacat, an anonymous researcher(Microsoft), Amy@@asentientbot, CVE-2025-32462, CVE-2025-53906, @@cloudlldb, Dennis Briner, Lukaah Marlowe, Rosyna Keller(Totally Not Malicious Software), Joshua Thomas, Dalibor Milanovic, Isaiah Wan, Will Caine, Thomas Salomon, Sufiyan Gouri (TU Darmstadt), Phil Scott & Richard Hyunho Im (@richeeta)@@MrPeriPeri, Mark Bowers, Joey Hewitt, Dylan Rollins, Arthur Baudoin, Andr.Ess, Mikael Kinnman, Lehan Dilusha Jayasinghe
Affected Software
13 affected componentsFixes available
Apple tvOS<26.1
26.1
Apple visionOS<26.1
26.1
Apple macOS Tahoe<26.1
26.1
Apple macOS Sequoia<15.7.2
15.7.2
Apple macOS Sonoma<14.8.2
14.8.2
Apple iOS<26.1
26.1
Apple iPadOS<26.1
26.1
Apple iPadOS<26.1
Apple iPhone OS<26.1
Apple macOS>=14.0<14.8.2
Apple macOS>=15.0<15.7.2
Apple tvOS<26.1
Apple visionOS<26.1
Event History
Nov 3, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
Description
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
WeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionAffected Software
Updated
via Apple·12:00 AM
Affected Software
Nov 4, 2025
CVE Published
via MITRE·01:17 AM
Data Sourced
via MITRE·01:17 AM
DescriptionWeakness
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-43407?
CVE-2025-43407 has been rated as a high-severity vulnerability due to its potential impact on permissions and privacy.
2
How do I fix CVE-2025-43407?
To resolve CVE-2025-43407, update affected Apple products to version 26.1 for tvOS, visionOS, iOS, and iPadOS, and to version 15.7.2 for macOS Sequoia or 14.8.2 for macOS Sonoma.
3
What types of devices are affected by CVE-2025-43407?
CVE-2025-43407 affects devices running tvOS, visionOS, iOS, iPadOS, and specific versions of macOS.
4
What does CVE-2025-43407 involve?
CVE-2025-43407 involves a permissions issue that has been addressed through additional restrictions and improved checks.
5
When was CVE-2025-43407 disclosed?
CVE-2025-43407 was disclosed in an Apple advisory detailing multiple security improvements across affected products.