CVE-2025-43510
Apple Macos 14.0 – 14.8.2
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2025-43510 is a high-severity Improper Locking (CWE-667) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 29th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-43510 is a memory corruption vulnerability resulting from inadequate lock state checking that allows unexpected changes to memory shared between processes. It affects Apple platforms prior to the listed fixed releases, specifically iOS and iPadOS before 18.7.2 and 26.1, macOS Sequoia before 15.7.2, macOS Sonoma before 14.8.2, macOS Tahoe before 26.1, and tvOS, visionOS, and watchOS before 26.1. The flaw is tracked under CWE-667 and carries a CVSS 3.1 base score of 7.8.
A local attacker can exploit the issue by supplying a malicious application that requires user interaction to run. Successful exploitation grants the ability to alter shared memory across processes, producing high impacts on confidentiality, integrity, and availability without needing elevated privileges.
Apple security advisories at support.apple.com/en-us/125632 through 125636 state that the vulnerability is resolved in the updated releases by adding improved lock state checking. The current EPSS score of 0.0030 indicates low exploitation probability with no reported rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-203138
Vulnerability Data
A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS…
more
26.1. A malicious application may cause unexpected changes in memory shared between processes.
- CWE(s)
- KEV Date Added
- 20 March 2026
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include code reviews, static analysis, and concurrency standards that prevent improper locking.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions and locking errors before release.
Secure development lifecycle includes concurrency and locking requirements that reduce improper locking defects.
Application security requirements can mandate proper lock acquisition/release patterns.
Secure architecture principles address thread-safety and resource synchronization.
Secure coding standards directly prohibit missing or incorrect lock usage.
Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.