CVE-2025-43193
Published: 30 July 2025
Summary
CVE-2025-43193 is a critical-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-6 (Resource Availability) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely patching of the specific memory handling flaw fixed in macOS Sequoia 15.6, Sonoma 14.7.7, and Ventura 13.7.7.
Implements controls to improve memory handling and minimize impacts from uncontrolled resource consumption or corruption enabling app-based DoS.
Enforces resource limits to protect against uncontrolled memory consumption (CWE-400) leading to denial-of-service by unauthenticated network attackers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated network exploitation of memory handling flaw with full C/I/A impact directly enables initial access via public-facing service or application.
NVD Description
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause a denial-of-service.
Deeper analysisAI
CVE-2025-43193 is a high-severity vulnerability in Apple macOS, addressed through improved memory handling. It affects macOS Sequoia prior to version 15.6, macOS Sonoma prior to 14.7.7, and macOS Ventura prior to 13.7.7. Associated with CWE-400 (Uncontrolled Resource Consumption), the issue enables an app to cause a denial-of-service, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited over the network by an unauthenticated attacker with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing data exposure, modification, and system disruption beyond simple denial-of-service.
Apple security advisories confirm the issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7. Practitioners should apply these updates promptly, as detailed in the referenced support pages (e.g., https://support.apple.com/en-us/124149), and monitor additional disclosures on platforms like seclists.org for further details.
Details
- CWE(s)