CVE-2025-43520: Memory Corruption in Apple Systems

CVE-2025-43520 involves a memory corruption issue in the kernel of Apple systems. It affects iOS, iPadOS, macOS (Sequoia, Sonoma, Tahoe), tvOS, visionOS and watchOS. A malicious application can exploit this flaw to cause unexpected system termination or write data to kernel memory, compromising the integrity and security of the device.

The vulnerability carries a CVSS score of 5.5 (Medium), but the potential to write to kernel memory makes it significant for system administrators. The flaw was fixed in December 2025 with specific patches for each platform. However, an important signal: in October 2026, public GitHub repositories were reported with proof-of-concept attempts that claim to contain working exploits. This increases risk for systems that have not yet received updates.

The first action is to audit the organizational device fleet: ensure all iOS, iPadOS and macOS devices are updated to the correct versions (18.7.2 or higher for iOS/iPadOS, 15.7.2 for Sequoia, 14.8.2 for Sonoma, 26.1 for newer systems). If automatic update policy is not enabled, activate it immediately. Monitor any unmanaged devices that are not updating automatically. If your environment contains very old devices no longer supported by Apple, plan their retirement from the network.

Although the patch has been available for over 9 months, the emergence of PoC exploits is a reminder that some organizations have not applied these critical updates. Sysadmins managing heterogeneous environments with personal devices (BYOD) must clearly communicate the update requirement to employees. Additionally, use mobile device management (MDM) tools to enforce updates on corporate devices.