Cyber Resilience

CVE-2025-43510

Apple Macos 14.0 – 14.8.2

CISA KEVActive ExploitationEUVD Exploited
Published
12 December 2025
Modified
03 April 2026
KEV Added
20 March 2026
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0036 29th percentile
Risk Priority 83 floored blend · peak EPSS

Summary

CVE-2025-43510 is a high-severity Improper Locking (CWE-667) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 29th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-43510 is a memory corruption vulnerability resulting from inadequate lock state checking that allows unexpected changes to memory shared between processes. It affects Apple platforms prior to the listed fixed releases, specifically iOS and iPadOS before 18.7.2 and 26.1, macOS Sequoia before 15.7.2, macOS Sonoma before 14.8.2, macOS Tahoe before 26.1, and tvOS, visionOS, and watchOS before 26.1. The flaw is tracked under CWE-667 and carries a CVSS 3.1 base score of 7.8.

A local attacker can exploit the issue by supplying a malicious application that requires user interaction to run. Successful exploitation grants the ability to alter shared memory across processes, producing high impacts on confidentiality, integrity, and availability without needing elevated privileges.

Apple security advisories at support.apple.com/en-us/125632 through 125636 state that the vulnerability is resolved in the updated releases by adding improved lock state checking. The current EPSS score of 0.0030 indicates low exploitation probability with no reported rise after disclosure.

EU & UK References

Vulnerability Data

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS…

more

26.1. A malicious application may cause unexpected changes in memory shared between processes.

CWE(s)
KEV Date Added
20 March 2026

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2021-1782Same product: Apple Ipadosboth on KEV
CVE-2025-24085Same product: Apple Ipadosboth on KEV
CVE-2025-43520Same product: Apple Ipadosboth on KEV
CVE-2026-20700Same product: Apple Ipadosboth on KEV
CVE-2025-31200Same product: Apple Ipadosboth on KEV
CVE-2024-23225Same product: Apple Ipadosboth on KEV
CVE-2024-23296Same product: Apple Ipadosboth on KEV
CVE-2025-43529Same product: Apple Ipadosboth on KEV
CVE-2022-48618Same product: Apple Ipadosboth on KEV
CVE-2025-31201Same product: Apple Ipadosboth on KEV

Affected Assets

apple
ipados
26.0 · ≤ 18.7.2
apple
iphone os
26.0 · ≤ 18.7.2
apple
macos
26.0 · 14.0 — 14.8.2 · 15.0 — 15.7.2
apple
tvos
≤ 26.1
apple
visionos
≤ 26.1
apple
watchos
≤ 26.1

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include code reviews, static analysis, and concurrency standards that prevent improper locking.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect race conditions and locking errors before release.

prevents

Secure development lifecycle includes concurrency and locking requirements that reduce improper locking defects.

prevents

Application security requirements can mandate proper lock acquisition/release patterns.

prevents

Secure architecture principles address thread-safety and resource synchronization.

prevents

Secure coding standards directly prohibit missing or incorrect lock usage.

prevents

Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.

References