CVE-2025-43359

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-43359 is a logic issue in Apple's operating systems that was addressed through improved state management. The vulnerability causes a UDP server socket, intended to be bound to a local interface, to instead become bound to all interfaces, potentially exposing it network-wide. It affects iOS and iPadOS versions prior to 18.7 and 26, macOS Sequoia prior to 15.7, macOS Sonoma prior to 14.8, macOS Tahoe prior to 26, tvOS prior to 26, visionOS prior to 26, and watchOS prior to 26. The issue is tracked under CWE-670 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

A remote network attacker with no privileges or user interaction required can exploit this vulnerability due to its low attack complexity. Successful exploitation allows high-impact disruption to confidentiality, integrity, and availability, stemming from the unintended socket binding that could enable broader access or manipulation of network services.

Apple's security advisories detail mitigations through patches released in the specified versions: iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26. Further details are available in the vendor's support documents at https://support.apple.com/en-us/125108, https://support.apple.com/en-us/125109, https://support.apple.com/en-us/125110, https://support.apple.com/en-us/125111, and https://support.apple.com/en-us/125112. Security practitioners should prioritize updating affected devices to these versions.