SB2025073151 - Multiple vulnerabilities in Apple iOS and iPadOS
Published: July 31, 2025 Updated: October 16, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 32 secuirty vulnerabilities.
1) Memory corruption (CVE-ID: CVE-2025-31281)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected app termination.
2) Input validation error (CVE-ID: CVE-2025-6558)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in ANGLE and GPU. A remote attacker can trick the victim into opening a specially crafted web page and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.
3) Use after free (CVE-ID: CVE-2025-43216)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and crash the browser.
4) Out-of-bounds read (CVE-ID: CVE-2025-43265)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds read error and read contents of memory on the system.
5) Memory corruption (CVE-ID: CVE-2025-43211)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
6) Memory corruption (CVE-ID: CVE-2025-43212)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
7) Memory corruption (CVE-ID: CVE-2025-43213)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
8) Memory corruption (CVE-ID: CVE-2025-43214)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
9) Buffer overflow (CVE-ID: CVE-2025-31273)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
10) Buffer overflow (CVE-ID: CVE-2025-31277)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
11) Buffer overflow (CVE-ID: CVE-2025-31278)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
12) State issues (CVE-ID: CVE-2025-43227)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a state management issue in WebKit. A remote attacker can trick the victim into opening a specially crafted website and gain access to sensitive information.
13) Spoofing attack (CVE-ID: CVE-2025-43228)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can spoof the address bar.
14) Memory corruption (CVE-ID: CVE-2025-43221)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and execute arbitrary code on the system.
15) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-31229)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions within the Accessibility feature that allows to read the passcode aloud via the VoiceOver feature.
16) Memory corruption (CVE-ID: CVE-2025-43224)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and execute arbitrary code on the system.
17) Improper input validation (CVE-ID: CVE-2025-43234)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Metal. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
18) Information disclosure (CVE-ID: CVE-2025-31276)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to Mail Drafts can load remote content when the 'Load Remote Images' setting is turned off. A remote attacker can gain unauthorized access to sensitive information.
19) Type confusion (CVE-ID: CVE-2025-7424)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in xmlNode.psvi. A remote attacker can pass specially crafted XML input to the application, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
20) Use-after-free (CVE-ID: CVE-2025-7425)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the xsltSetSourceNodeFlags() function. A remote attacker can pass specially crafted XML input to the application, trigger memory corruption and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
21) Buffer overflow (CVE-ID: CVE-2025-43202)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in libnetcore. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
22) Improper input validation (CVE-ID: CVE-2025-43226)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
23) Memory corruption (CVE-ID: CVE-2025-43209)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ICU. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.
24) Improper access control (CVE-ID: CVE-2025-43230)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in CoreMedia Playback. A local application can access user-sensitive data.
25) Memory corruption (CVE-ID: CVE-2025-43210)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
26) Buffer overflow (CVE-ID: CVE-2025-43277)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in CoreAudio when processing media files. A remote attacker can create a specially crafted media file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
27) Improper input validation (CVE-ID: CVE-2025-43223)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in CFNetwork. A local user can modify restricted network settings.
28) Memory corruption (CVE-ID: CVE-2025-43186)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in afclip. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected app termination.
29) Multiple Interpretations of UI Input (CVE-ID: CVE-2025-43217)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to privacy Indicators for microphone or camera access may not be correctly displayed. A remote attacker can trick the victim into sharing sensitive information with a third-party.
30) Resource management error (CVE-ID: CVE-2025-43282)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the OS kernel. A local application can cause unexpected system termination.
31) Buffer overflow (CVE-ID: CVE-2025-6965)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing aggregated terms. A remote attacker can pass specially crafted input to the application where the number of aggregate terms exceeds the number of columns available, trigger memory corruption and perform a denial of service (DoS) attack.
32) Security features bypass (CVE-ID: CVE-2025-43280)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists in Mail Drafts implementation when forwarding an email with included remote images while in Lockdown Mode. A remote attacker can gain access to sensitive information if the victim decides to forward such an email.
Remediation
Install update from vendor's website.