1. Home
  2. Vulnerabilities
  3. CVE-2025-43400
6.3
MEDIUM CVSS 3.1
CVE-2025-43400
Apple Font Out-of-Bounds Write Vulnerability
Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in watchOS 26.1, tvOS 26.1. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.

INFO

Published Date :

Sept. 29, 2025, 6:15 p.m.

Last Modified :

Nov. 4, 2025, 10:16 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
Affected Products

The following products are affected by CVE-2025-43400 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Apple macos
2 Apple iphone_os
3 Apple tvos
4 Apple watchos
5 Apple ipados
6 Apple visionos
: Total Affected Vendor : 1 | Products : 6
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 MEDIUM 134c704f-9b21-4f2e-91b3-4a467353bcc0
Solution
Update affected macOS, visionOS, iOS, and iPadOS systems to the latest versions.
  • Apply macOS Sonoma 14.8.1 update.
  • Apply macOS Tahoe 26.0.1 update.
  • Apply macOS Sequoia 15.7.1 update.
  • Apply visionOS 26.0.1 update.
Public PoC/Exploit Available at Github

CVE-2025-43400 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-43400.

URL Resource
https://support.apple.com/en-us/125637
https://support.apple.com/en-us/125639
http://seclists.org/fulldisclosure/2025/Sep/73
http://seclists.org/fulldisclosure/2025/Sep/76
http://seclists.org/fulldisclosure/2025/Sep/78
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-43400 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-43400 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
coccoa-sudo/Research-Exploits-and-Tool-iOS-Bypass

iOS 26 bypass process using the available libimobiledevice tools and CVE exploitation techniques discussed.

Updated: 4 days, 8 hours ago
0 stars 0 fork 0 watcher
Born at : Nov. 2, 2025, 4:43 p.m. This repo has been linked 25 different CVEs too.
Profile Photo
Karmaz95/Snake_Apple

Articles and tools related to research in the Apple environment (mainly macOS).

apple macos reverse-engineering vulnerability-detection vulnerability-research binary-analysis binary-exploitation macho macho-parser parser python exploitation ios programming sandbox apple-silicon applescript

C C++ Python Shell Objective-C DTrace JavaScript Swift Makefile

Updated: 1 day, 8 hours ago
239 stars 26 fork 26 watcher
Born at : Dec. 5, 2023, 4:59 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-43400 vulnerability anywhere in the article.

  • Help Net Security
October 2025 Patch Tuesday forecast: The end of a decade with Microsoft

A lot of classic software is reaching end-of-life (EOL) this month. Windows 10, Office 2016 and Exchange Server 2016 have survived after nearly a decade of service. Not far behind, after six years in ... Read more

Published Date: Oct 10, 2025 (3 weeks, 6 days ago)
  • The Hacker News
⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field. This recap cuts through the noise to share ... Read more

Published Date: Oct 06, 2025 (1 month ago)
  • seclists.org
APPLE-SA-09-29-2025-6 visionOS 26.0.1

Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Mon, 29 Sep 2025 12:58:26 -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ... Read more

Published Date: Sep 30, 2025 (1 month, 1 week ago)
  • seclists.org
APPLE-SA-09-29-2025-5 macOS Sonoma 14.8.1

Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Mon, 29 Sep 2025 12:57:56 -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ... Read more

Published Date: Sep 30, 2025 (1 month, 1 week ago)
  • seclists.org
APPLE-SA-09-29-2025-4 macOS Sequoia 15.7.1

Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Mon, 29 Sep 2025 12:57:15 -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ... Read more

Published Date: Sep 30, 2025 (1 month, 1 week ago)
  • seclists.org
APPLE-SA-09-29-2025-3 macOS Tahoe 26.0.1

Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Mon, 29 Sep 2025 12:56:45 -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ... Read more

Published Date: Sep 30, 2025 (1 month, 1 week ago)
  • seclists.org
APPLE-SA-09-29-2025-2 iOS 18.7.1 and iPadOS 18.7.1

Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Mon, 29 Sep 2025 12:56:15 -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ... Read more

Published Date: Sep 30, 2025 (1 month, 1 week ago)
  • seclists.org
APPLE-SA-09-29-2025-1 iOS 26.0.1 and iPadOS 26.0.1

Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Mon, 29 Sep 2025 12:55:45 -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ... Read more

Published Date: Sep 30, 2025 (1 month, 1 week ago)
  • The Cyber Express
Apple Security Update Addresses Critical Font Parser Vulnerability Across Multiple Platforms

Apple has rolled out a series of important security updates across multiple platforms, addressing a vulnerability affecting the system font parser. These Apple security updates cover iOS, iPadOS, macO ... Read more

Published Date: Sep 30, 2025 (1 month, 1 week ago)
  • security.nl
Apple dicht beveiligingslek in iOS en macOS bij het verwerken van fonts

dinsdag 30 september 2025, 09:26 door Redactie, 1 reactiesLaatst bijgewerkt: Vandaag, 10:12 Apple heeft beveiligingsupdates uitgebracht voor iOS, iPadOS en macOS die één kwetsbaarheid verhelpen, die z ... Read more

Published Date: Sep 30, 2025 (1 month, 1 week ago)
  • CybersecurityNews
Apple Font Parser Vulnerability Enables Malicious Fonts to Crash or Corrupt Process Memory

Apple has rolled out security updates across its operating systems to address a vulnerability in the Font Parser component that could allow malicious fonts to crash applications or corrupt process mem ... Read more

Published Date: Sep 30, 2025 (1 month, 1 week ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-43400 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 04, 2025

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2025/Sep/73
    Added Reference http://seclists.org/fulldisclosure/2025/Sep/76
  • CVE Modified by [email protected]

    Nov. 04, 2025

    Action Type Old Value New Value
    Changed Description An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sonoma 14.8.1, macOS Tahoe 26.0.1, macOS Sequoia 15.7.1, visionOS 26.0.1, iOS 26.0.1 and iPadOS 26.0.1, iOS 18.7.1 and iPadOS 18.7.1. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory. An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in watchOS 26.1, tvOS 26.1. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
    Added Reference https://support.apple.com/en-us/125637
    Added Reference https://support.apple.com/en-us/125639
    Removed Reference https://support.apple.com/en-us/125326
    Removed Reference https://support.apple.com/en-us/125327
    Removed Reference https://support.apple.com/en-us/125328
    Removed Reference https://support.apple.com/en-us/125329
    Removed Reference https://support.apple.com/en-us/125330
    Removed Reference https://support.apple.com/en-us/125338
    Removed Reference Type https://support.apple.com/en-us/125326 Types: Release Notes, Vendor Advisory
    Removed Reference Type https://support.apple.com/en-us/125327 Types: Release Notes, Vendor Advisory
    Removed Reference Type https://support.apple.com/en-us/125328 Types: Release Notes, Vendor Advisory
    Removed Reference Type https://support.apple.com/en-us/125329 Types: Release Notes, Vendor Advisory
    Removed Reference Type https://support.apple.com/en-us/125330 Types: Release Notes, Vendor Advisory
    Removed Reference Type https://support.apple.com/en-us/125338 Types: Release Notes, Vendor Advisory
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 03, 2025

    Action Type Old Value New Value
    Added Reference http://seclists.org/fulldisclosure/2025/Sep/78
  • Initial Analysis by [email protected]

    Sep. 30, 2025

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 14.0 up to (excluding) 14.8.1 *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 15.0 up to (excluding) 15.7.1 *cpe:2.3:o:apple:macos:26.0:*:*:*:*:*:*:* *cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* versions up to (excluding) 26.0.1 *cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* versions up to (excluding) 18.7.1 *cpe:2.3:o:apple:ipados:26.0:*:*:*:*:*:*:* *cpe:2.3:o:apple:iphone_os:26.0:*:*:*:*:*:*:* *cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* versions up to (excluding) 18.7.1
    Added Reference Type Apple Inc.: https://support.apple.com/en-us/125326 Types: Release Notes, Vendor Advisory
    Added Reference Type Apple Inc.: https://support.apple.com/en-us/125327 Types: Release Notes, Vendor Advisory
    Added Reference Type Apple Inc.: https://support.apple.com/en-us/125328 Types: Release Notes, Vendor Advisory
    Added Reference Type Apple Inc.: https://support.apple.com/en-us/125329 Types: Release Notes, Vendor Advisory
    Added Reference Type Apple Inc.: https://support.apple.com/en-us/125330 Types: Release Notes, Vendor Advisory
    Added Reference Type Apple Inc.: https://support.apple.com/en-us/125338 Types: Release Notes, Vendor Advisory
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Sep. 29, 2025

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    Added CWE CWE-787
  • New CVE Received by [email protected]

    Sep. 29, 2025

    Action Type Old Value New Value
    Added Description An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sonoma 14.8.1, macOS Tahoe 26.0.1, macOS Sequoia 15.7.1, visionOS 26.0.1, iOS 26.0.1 and iPadOS 26.0.1, iOS 18.7.1 and iPadOS 18.7.1. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
    Added Reference https://support.apple.com/en-us/125326
    Added Reference https://support.apple.com/en-us/125327
    Added Reference https://support.apple.com/en-us/125328
    Added Reference https://support.apple.com/en-us/125329
    Added Reference https://support.apple.com/en-us/125330
    Added Reference https://support.apple.com/en-us/125338
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 6.3
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact