Product:
tvOS, macOS, iOS, iPadOS, visionOS, watchOS
Summary
A logic issue was addressed with improved state management. This issue affects multiple Apple operating systems, allowing a UDP server socket bound to a local interface to become bound to all interfaces. The issue has been fixed in various versions of Apple’s software.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-43359 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted UDP packets to the affected device. If successful, the attacker may gain unauthorized access to the device’s network interfaces, potentially leading to further exploitation of the system or data leakage.
Affected Products
- tvOS 26: Latest version with improved state management.
- macOS Sonoma 14.8: Updated to address the logic issue.
- macOS Sequoia 15.7: Includes the fix for the vulnerability.
- iOS 18.7: Patched to prevent exploitation.
- iPadOS 18.7: Updated to mitigate the issue.
- visionOS 26: Fixed in the latest release.
- watchOS 26: Addressed in the recent update.
- macOS Tahoe 26: Includes the necessary security improvements.
- iOS 26: Updated to resolve the vulnerability.
- iPadOS 26: Patched to enhance security.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Regularly applying security updates and patches is essential to protect against potential exploits.