7.8Yüksek KEV

CVE-2025-43510Apple Multiple Products Improper Locking Vulnerability

Apple iOS and iPadOS; Apple macOS; Apple tvOS; Apple visionOS Yayım: 2025-12-12 23:56 (10 ay önce)

Aktif olarak istismar ediliyor — Apple Multiple Products Improper Locking Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 20.03.2026 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 03.04.2026.

Gerekli işlem: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.apple.com/en-us/125632 ; https://support.apple.com/en-us/125633 ; https://support.apple.com/en-us/125634 ; https://support.apple.com/en-us/125635 ; https://support.apple.com/en-us/125636 ; https://support.apple.com/en-us/125637 ; https://support.apple.com/en-us/125638 ; https://support.apple.com/en-us/125639 ; https://nvd.nist.gov/vuln/detail/CVE-2025-43510

Açıklama

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.

Zayıflık türü (CWE): CWE-667

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
Apple	iOS and iPadOS	< 18.7.2, < 26.1
apple	ipados	< 18.7.2
apple	iphone os	< 18.7.2
Apple	macOS	< 14.8.2, < 15.7.2, < 26.1
Apple	tvOS	< 26.1
Apple	visionOS	< 26.1
Apple	watchOS	< 26.1

Kaynaklar ve yamalar

https://support.apple.com/en-us/125632 Release NotesVendor Advisory
https://support.apple.com/en-us/125633 Release NotesVendor Advisory
https://support.apple.com/en-us/125634 Release NotesVendor Advisory
https://support.apple.com/en-us/125635 Release NotesVendor Advisory
https://support.apple.com/en-us/125636 Release NotesVendor Advisory
https://support.apple.com/en-us/125637 Release NotesVendor Advisory
https://support.apple.com/en-us/125638 Release NotesVendor Advisory
https://support.apple.com/en-us/125639 Release NotesVendor Advisory
https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/ Technical Description
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43510 US Government Resource

CPE eşleşmeleri (NVD) (10)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* < 18.7.2
cpe:2.3:o:apple:ipados:26.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* < 18.7.2
cpe:2.3:o:apple:iphone_os:26.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 14.0 < 14.8.2
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 15.0 < 15.7.2
cpe:2.3:o:apple:macos:26.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* < 26.1
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* < 26.1
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* < 26.1

CVSS puanı

7.8Yüksek

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Yerel
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tüm puanlar (3)

CISA-ADP	CVSS 3.1	7.8Yüksek
nvd	CVSS 3.1	7.8Yüksek
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8Yüksek

EPSS (30 günde istismar olasılığı)

0.36%

tüm CVE'lerin %29'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2025-04-16
Yayımlandı2025-12-12 23:56
IP-DB'ye ulaştı2026-10-24 23:29
KEV'e eklendi2026-03-20
Son güncelleme2026-10-07 14:10

Numarayı veren (CNA): apple
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Apple iOS / iPadOS

5.5Orta

CVE-2026-86925 7 gün önce

Apple iOS and iPadOS; Apple macOS; Apple visionOS

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data.

7.8Yüksek

CVE-2026-84627 7 gün önce

Apple iOS and iPadOS; Apple macOS; Apple visionOS

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2, visionOS 27. Processing a maliciously crafted image may lea…

Puansız

CVE-2026-86972 7 gün önce

Apple iOS and iPadOS; Apple macOS; Apple tvOS; Apple visionOS

A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted …

7.1Yüksek

CVE-2026-113912 7 gün önce

Apple iOS and iPadOS; Apple macOS; Apple tvOS; Apple visionOS

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a mali…

Puansız

CVE-2026-86964 7 gün önce

Apple iOS and iPadOS; Apple macOS; Apple tvOS; Apple visionOS

A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

Puansız

CVE-2026-113904 7 gün önce

Apple Safari; Apple iOS and iPadOS; Apple macOS; Apple tvOS

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted we…