SB2025091761 - Multiple vulnerabilities in Apple iOS 26 and iPadOS 26
Published: September 17, 2025 Updated: February 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 37 secuirty vulnerabilities.
1) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43329)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in Sandbox. A local application can break out of its sandbox.
2) Use after free (CVE-ID: CVE-2025-43368)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in WebKit Process Model. A remote attacker can trick the victim into opening a specially crafted website and crash the browser.
3) Improper access control (CVE-ID: CVE-2025-43342)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in WebKit. A remote attacker can trick the victim into opening a specially crafted website and crash the browser.
4) Memory corruption (CVE-ID: CVE-2025-43343)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and crash the browser.
5) Memory corruption (CVE-ID: CVE-2025-43272)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and crash the browser.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-43356)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to missing permissions checks. A remote attacker can trick the victim into visiting a specially crafted website and gain access to sensor information without user consent.
7) Information disclosure (CVE-ID: CVE-2025-24133)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to excessive data output in Keyboard suggestions. An attacker with access to the device can view keyboard suggestions on the lock screen.
8) Input validation error (CVE-ID: CVE-2025-43347)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the System component. A local application can perform a denial of service (DoS) attack.
9) Buffer overflow (CVE-ID: CVE-2025-6965)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing aggregated terms. A remote attacker can pass specially crafted input to the application where the number of aggregate terms exceeds the number of columns available, trigger memory corruption and perform a denial of service (DoS) attack.
10) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2025-43190)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to incorrect handling of path names in Spell Check. A local application can trick the victim into opening a specially crafted file and access sensitive user data.
11) Improper authentication (CVE-ID: CVE-2025-30468)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to improper state management in Siri. An attacker with access to the device can access Private Browsing tabs without authentication.
12) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-43358)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in Shortcuts. A local user can bypass sandbox restrictions.
13) Input validation error (CVE-ID: CVE-2025-31254)
The vulnerability allows a remote attacker to redirect users to a malicious website.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim into clicking on a specially crafted URL and redirect users to a malicious website.
14) Memory corruption (CVE-ID: CVE-2025-43344)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Apple Neural Engine. A local application can cause unexpected system termination.
15) Use of cache containing sensitive information (CVE-ID: CVE-2025-43203)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to improper caching in Notes. An attacker with physical access to an unlocked device may be able to view an image in the most recently viewed locked note.
16) Memory corruption (CVE-ID: CVE-2025-43355)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in MobileStorageMounter. A local application can cause a denial-of-service.
17) Improper access control (CVE-ID: CVE-2025-43362)
The vulnerability allows a local application to monitor keystrokes.
The vulnerability exists due to improper access restrictions in LaunchServices. A local application can monitor keystrokes without user permission.
18) State Issues (CVE-ID: CVE-2025-43359)
The vulnerability allows a remote attacker to gain unauthorized access to the system.
The vulnerability exists due to a log error within the OS kernel. A UDP server socket bound to a local interface may become bound to all interfaces exposing services on the Internet.
19) State issues (CVE-ID: CVE-2025-31255)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in IOKit. A local application can access sensitive user data.
20) Out-of-bounds write (CVE-ID: CVE-2025-43302)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in IOHIDFamily. A local application can cause unexpected system termination.
21) Improper input validation (CVE-ID: CVE-2025-43372)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
22) Out-of-bounds write (CVE-ID: CVE-2025-43349)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in CoreAudio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
23) Information disclosure (CVE-ID: CVE-2025-43357)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the Call History. A local application can fingerprint the user.
24) Information exposure through log files (CVE-ID: CVE-2025-43303)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Bluetooth. A local application can access sensitive user data.
25) Information exposure through log files (CVE-ID: CVE-2025-43354)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Bluetooth. A local application can access sensitive user data.
26) Memory corruption (CVE-ID: CVE-2025-43346)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Audio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
27) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43317)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in AppleMobileFileIntegrity. A local application can access sensitive user data.
28) Insufficient UI Warning of Dangerous Operations (CVE-ID: CVE-2025-43360)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to an UI issue in Authentication Services leading to password fields being unintentionally revealed. An attacker with physical access to device can view passwords.
29) Information disclosure (CVE-ID: CVE-2025-43309)
The vulnerability allows an attacker to gain access to potentially sensitive information.
The vulnerability exists due to missing checks in Notifications. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen.
30) Input validation error (CVE-ID: CVE-2025-43365)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in MetricKit. A local unprivileged process can terminate a root processes.
31) Out-of-bounds read (CVE-ID: CVE-2025-43361)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the Audio subsystem. A local application can trigger an out-of-bounds read error and read contents of kernel memory.
32) Improper access control (CVE-ID: CVE-2025-43323)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in CloudKit. A local application can fingerprint the user.
33) Out-of-bounds write (CVE-ID: CVE-2025-43338)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in ImageIO. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
34) Improper access control (CVE-ID: CVE-2025-43345)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Kernel. A local application can access sensitive user data.
35) Buffer overflow (CVE-ID: CVE-2025-43419)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
36) Information disclosure (CVE-ID: CVE-2025-43376)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a logic issue in WebKit. A remote attacker can view leaked DNS queries with Private Relay turned on.
37) Out-of-bounds read (CVE-ID: CVE-2025-46306)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
Remediation
Install update from vendor's website.