SB2025110435 - Multiple vulnerabilities in Apple iOS 26 and iPadOS 26
Published: November 4, 2025 Updated: February 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 62 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2025-43435)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.
2) Security features bypass (CVE-ID: CVE-2025-43502)
The vulnerability allows a local application to bypass certain Privacy preferences.
The vulnerability exists due to an error in Safari. A local application can bypass certain Privacy preferences.
3) Improper input validation (CVE-ID: CVE-2025-43500)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Sandbox Profiles. A local application can access sensitive user data.
4) State Issues (CVE-ID: CVE-2025-43454)
The vulnerability allows an attacker to gain unauthorized access to device.
The vulnerability exists due to a state issue in Siri where a device may persistently fail to lock. An attacker with physical access to device can compromise it.
5) Information disclosure (CVE-ID: CVE-2025-43460)
The vulnerability allows an attacker to gain access to potentially sensitive information.
The vulnerability exists due to improper checks in Status Bar. An attacker with physical access to a locked device may be able to view sensitive user information.
6) Protection Mechanism Failure (CVE-ID: CVE-2025-43422)
The vulnerability allows an attacker to bypass implemented security restrictions.
The vulnerability exists due to a missing logic in Stolen Device Protection. An attacker with physical access to a device may be able to disable Stolen Device Protection.
7) Information disclosure (CVE-ID: CVE-2025-43452)
The vulnerability allows an attacker to gain access to potentially sensitive information.
The vulnerability exists due to Keyboard suggestions can display sensitive information on the lock screen. An attacker with physical access to a locked device can gain access to sensitive information.
8) Security features bypass (CVE-ID: CVE-2025-43480)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and exfiltrate data cross-origin.
9) Input validation error (CVE-ID: CVE-2025-43458)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into opening a specially crafted web page and crash the browser.
10) Input validation error (CVE-ID: CVE-2025-43430)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into opening a specially crafted web page and crash the browser.
11) State issues (CVE-ID: CVE-2025-43427)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a state management issue in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.
12) Input validation error (CVE-ID: CVE-2025-43443)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.
13) Buffer overflow (CVE-ID: CVE-2025-43441)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.
14) Buffer overflow (CVE-ID: CVE-2025-43425)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.
15) Spoofing attack (CVE-ID: CVE-2025-43493)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can trick the victim into clicking on a specially crafted URL and spoof the browser's address bar.
16) Input validation error (CVE-ID: CVE-2025-43440)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser.
17) Use-after-free (CVE-ID: CVE-2025-43438)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
18) Use-after-free (CVE-ID: CVE-2025-43457)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
19) Use after free (CVE-ID: CVE-2025-43434)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.
20) Security features bypass (CVE-ID: CVE-2025-43495)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper checks in WebKit. A local application can monitor keystrokes without user permission.
21) Buffer overflow (CVE-ID: CVE-2025-43433)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website. trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
22) Buffer overflow (CVE-ID: CVE-2025-43431)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website. trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
23) Use-after-free (CVE-ID: CVE-2025-43432)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
24) Buffer overflow (CVE-ID: CVE-2025-43429)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.
25) Buffer overflow (CVE-ID: CVE-2025-43421)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.
26) Improper access control (CVE-ID: CVE-2025-43392)
The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.
The vulnerability exists due to incorrect handling of cached data in WebKit Canvas. A remote attacker can trick the victim into visiting a specially crafted website and exfiltrate data cross-origin.
27) Spoofing attack (CVE-ID: CVE-2025-43503)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can trick the victim into visiting a specially crafted website and spoof the user interface.
28) Improper input validation (CVE-ID: CVE-2025-43391)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Photos. A local application can trick the victim into opening a specially crafted file and access sensitive user data.
29) Improper access control (CVE-ID: CVE-2025-43442)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Accessibility feature. A local application can installed apps on the device.
30) Improper input validation (CVE-ID: CVE-2025-43445)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in CoreText. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
31) Improper access control (CVE-ID: CVE-2025-43455)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Apple Account. A local application can take a screenshot of sensitive information in embedded views.
32) Memory corruption (CVE-ID: CVE-2025-43447)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Apple Neural Engine. A local application can cause unexpected system termination or corrupt kernel memory.
33) Memory corruption (CVE-ID: CVE-2025-43462)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Apple Neural Engine. A local application can cause unexpected system termination or corrupt kernel memory.
34) Information disclosure (CVE-ID: CVE-2025-43449)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to incorrect handling of cache in Apple TV Remote. A local application can track users between installs.
35) Improper link resolution before file access ('link following') (CVE-ID: CVE-2025-43379)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insecure symbolic link following in AppleMobileFileIntegrity. A local application can access protected user data.
36) Protection Mechanism Failure (CVE-ID: CVE-2025-43407)
The vulnerability allows a local application to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in Assets. A local application can break out of its sandbox.
37) Information exposure through log files (CVE-ID: CVE-2025-43423)
The vulnerability allows an attacker with physical access to the system to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Audio. An attacker with physical access to the system can view sensitive user information in system logging.
38) State Issues (CVE-ID: CVE-2025-43450)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper checks in Camera. A local application can learn information about the current camera view before being granted camera access.
39) Improper link resolution before file access ('link following') (CVE-ID: CVE-2025-43448)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insecure symbolic link following in CloudKit. A local application can break out of its sandbox.
40) Information exposure through log files (CVE-ID: CVE-2025-43426)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Contacts. A local application can access sensitive user data.
41) Improper access control (CVE-ID: CVE-2025-43350)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Control Center. An attacker with physical access to device can view restricted content from the lock screen.
42) Improper access control (CVE-ID: CVE-2025-43436)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in CoreServices. A local application can enumerate installed apps on the device.
43) State issues (CVE-ID: CVE-2025-43498)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in FileProvider. A local application can access sensitive user data.
44) Information disclosure (CVE-ID: CVE-2025-43439)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to an error within On-device Intelligence. A local application can fingerprint the user.
45) Information disclosure (CVE-ID: CVE-2025-43507)
The vulnerability allows a local application to fingerprint the user.
The vulnerability exists due to excessive data output by the Find My application. A local application can fingerprint the user.
46) Information disclosure (CVE-ID: CVE-2025-43444)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to excessive data output by the Installer application. A malicious local application can fingerprint the user.
47) Memory corruption (CVE-ID: CVE-2025-43398)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.
48) Improper access control (CVE-ID: CVE-2025-43413)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in libxpc. A local application can observe system-wide network connections.
49) Security features bypass (CVE-ID: CVE-2025-43496)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a missing logic in Mail Drafts when working with email messages. A remote attacker can force the application to load remote content even when the 'Load Remote Images' setting is turned off.
50) Improper input validation (CVE-ID: CVE-2025-43294)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in MallocStackLogging. A local application can access sensitive user data.
51) Memory corruption (CVE-ID: CVE-2025-43386)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
52) Memory corruption (CVE-ID: CVE-2025-43385)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
53) Memory corruption (CVE-ID: CVE-2025-43384)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
54) Memory corruption (CVE-ID: CVE-2025-43383)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
55) Buffer overflow (CVE-ID: CVE-2025-43424)
The vulnerability allows an attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Multi-Touch. A malicious HID device can crash the process.
56) Improper input validation (CVE-ID: CVE-2025-43389)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in Notes. A local application can access sensitive user data.
57) Information disclosure (CVE-ID: CVE-2025-43437)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in Managed Configuration. A local application can fingerprint the user on the device.
58) Buffer overflow (CVE-ID: CVE-2025-43510)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and cause unexpected changes in memory shared between processes.
59) Buffer overflow (CVE-ID: CVE-2025-43520)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code on the target system.
60) Input validation error (CVE-ID: CVE-2025-43494)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of email headers in the Mail app. A remote attacker can send a specially crafted email to the victim and cause a persistent denial-of-service.
61) Information disclosure (CVE-ID: CVE-2025-43418)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to excessive data output in Spotlight. An attacker with physical access to a locked device may be able to view sensitive user information.
62) Out-of-bounds read (CVE-ID: CVE-2025-46316)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
Remediation
Install update from vendor's website.