CVE-2025-43448: Use After Free
Published Nov 3, 2025
·Updated
Accessibility. A permissions issue was addressed with additional restrictions.
Credit
Mickey Jin@@patch1t, Gergely Kalman@@gergely_kalman, Joseph Ravichandran@@0xjprx(MIT CSAIL), Dave G. (supernetworks.org), JZ, Zhongcheng Li(IES Red Team of ByteDance), Michael Reeves@@IntegralPilot, Morris Richman@@morrisinlife, Csaba Fitzl@@theevilbit(Kandji), Hikerell (Loadshine Lab), 이동하 (Lee Dong Ha(BoB 14th), wac(Trend Micro Zero Day Initiative), an anonymous researcher, Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), pattern-f@@pattern_F_, Ferdous Saljooki@@malwarezoo(Jamf), Murray Mike, 이동하 (Lee Dong Ha)(SSA Lab), Cristian Dinca (icmd.tech), Apple, Dave G.(supernetworks), Alex Radocea(supernetworks), Taavi Eomäe(Zone Media), Kirin@@Pwnrin, Atul R V, Asaf Cohen, CVE-2024-43398, CVE-2024-49761, CVE-2025-6442, Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir, Nikolai Skliarenko(Trend Micro Zero Day Initiative), Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Alexia Wilson(Microsoft), Christine Fossaceca(Microsoft), Wang Yu(Cyberserval), Ryan Dowd@@_rdowd, Ron Masas(BreakPoint), Pinak Oza, iisBuri, Romain Lebesle(Khatima), Himanshu Bharti@@Xpl0itme(Khatima), Dalibor Milanovic, @@RenwaX23, Stanislav Jelezoglo, Aleksejs Popovs, Phil Beauvoir, Google Big Sleep, Nan Wang@@eternalsakura13, rheza@@ginggilBesel(Trend Micro Zero Day Initiative), shandikri(Trend Micro Zero Day Initiative), Gary Kwong(Trend Micro Zero Day Initiative), Justin Cohen(Google), Tom Van Goethem, Nolan Astrein(Kandji), Duy Trần@@khanhduytran0, Adwiteeya Agrawal, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), BynarIO AI (bynar.io), Kirin@@Pwnrin(Microsoft), Dennis Briner, Minghao Lin@@Y1nKoc, Lyutoon@@Lyutoon_, YingQi Shi@@Mas0n, Joshua Thomas, rheza@@ginggilBesel, Lehan Dilusha Jayasinghe, Gary Kwong, Wojciech Regula(SecuRing), Kirin@@Pwnrin(Fudan University), LFY@@secsys(Fudan University), Kenneth Chew, @@EthanArbuckle, Google Threat Analysis Group, Doug Hogan, KPC(Cisco Talos), Zhongquan Li@@Guluisacat, an anonymous researcher(Microsoft), Amy@@asentientbot, CVE-2025-32462, CVE-2025-53906, @@cloudlldb, Lukaah Marlowe, Rosyna Keller(Totally Not Malicious Software), Isaiah Wan, Will Caine, Thomas Salomon, Sufiyan Gouri (TU Darmstadt), Phil Scott & Richard Hyunho Im (@richeeta)@@MrPeriPeri, Mark Bowers, Joey Hewitt, Dylan Rollins, Arthur Baudoin, Andr.Ess, Mikael Kinnman
Affected Software
17 affected componentsFixes available
Apple WatchOS<26.1
26.1
Apple tvOS<26.1
26.1
Apple visionOS<26.1
26.1
Apple macOS Tahoe<26.1
26.1
Apple macOS Sequoia<15.7.2
15.7.2
Apple macOS Sonoma<14.8.2
14.8.2
Apple iOS<26.1
26.1
Apple iPadOS<26.1
26.1
Apple iPadOS<26.1
Apple iPhone OS<26.1
Apple macOS<14.8.2
Apple macOS>=15.0<15.7.2
Apple tvOS<26.1
Apple visionOS<26.1
Apple WatchOS<26.1
Apple iOS<18.7.2
18.7.2
Apple iPadOS<18.7.2
18.7.2
Event History
Nov 3, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
Description
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
WeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionAffected Software
Updated
via Apple·12:00 AM
Affected Software
Nov 4, 2025
CVE Published
via MITRE·01:15 AM
Data Sourced
via MITRE·01:15 AM
DescriptionWeakness
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Nov 5, 2025
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-43448?
CVE-2025-43448 is characterized as a moderate severity vulnerability due to its potential impact on accessibility and privacy.
2
How do I fix CVE-2025-43448?
To mitigate CVE-2025-43448, users should update to the latest versions of affected Apple software, specifically those newer than 26.1 for watchOS, tvOS, visionOS, iOS, and iPadOS.
3
What products are affected by CVE-2025-43448?
CVE-2025-43448 affects multiple Apple products including watchOS, tvOS, visionOS, iOS, iPadOS, and specific versions of macOS.
4
What types of issues does CVE-2025-43448 address?
CVE-2025-43448 addresses permissions, logic, and privacy issues within Apple’s Admin Framework and other components.
5
Are there known exploits for CVE-2025-43448?
As of now, there are no publicly known exploits specifically targeting CVE-2025-43448.