Apple visionOS vulnerabilities

CVE-2025-43503 [MEDIUM] CWE-290 CVE-2025-43503: An inconsistent user interface issue was addressed with improved state management. This issue is fix An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Visiting a malicious website may lead to user interface spoofing.

CVE-2025-43498 [MEDIUM] CWE-284 CVE-2025-43498: An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.1 An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1. An app may be able to access sensitive user data.

CVE-2025-43398 [MEDIUM] CWE-119 CVE-2025-43398: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to cause unexpected system termination.

CVE-2025-43507 [MEDIUM] CWE-276 CVE-2025-43507: A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to fingerprint the user.

CVE-2025-43445 [MEDIUM] CWE-125 CVE-2025-43445: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 18.7. An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process m

CVE-2025-43384 [MEDIUM] CWE-125 CVE-2025-43384: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iO An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

CVE-2025-43385 [MEDIUM] CWE-125 CVE-2025-43385: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iO An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

CVE-2025-43429 [MEDIUM] CWE-119 CVE-2025-43429: A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, i A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43444 [MEDIUM] CWE-276 CVE-2025-43444: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.2 an A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to fingerprint the user.

CVE-2025-43455 [MEDIUM] CWE-200 CVE-2025-43455: A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1, A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. A malicious app may be able to take a screenshot of sensitive information in embedded views.

CVE-2025-43440 [MEDIUM] CWE-79 CVE-2025-43440: This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPad This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43447 [MEDIUM] CWE-787 CVE-2025-43447: The issue was addressed with improved memory handling. This issue is fixed in iOS 26.1 and iPadOS 26 The issue was addressed with improved memory handling. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2025-43493 [MEDIUM] CWE-290 CVE-2025-43493: The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPa The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Visiting a malicious website may lead to address bar spoofing.

CVE-2025-43432 [MEDIUM] CWE-416 CVE-2025-43432: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43425 [MEDIUM] CWE-119 CVE-2025-43425: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 26.1 The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43439 [MEDIUM] CWE-359 CVE-2025-43439: A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.2 and iPad A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, visionOS 26.1. An app may be able to fingerprint the user.

CVE-2025-43435 [MEDIUM] CWE-119 CVE-2025-43435: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7. The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43448 [MEDIUM] CWE-59 CVE-2025-43448: This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.2 and This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to break out of its sandbox.

CVE-2025-43457 [MEDIUM] CWE-416 CVE-2025-43457: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVE-2025-43430 [MEDIUM] CWE-20 CVE-2025-43430: This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.