SB2025073155 - Multiple vulnerabilities in Apple tvOS
Published: July 31, 2025 Updated: October 16, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 26 secuirty vulnerabilities.
1) State issues (CVE-ID: CVE-2025-43227)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a state management issue in WebKit. A remote attacker can trick the victim into opening a specially crafted website and gain access to sensitive information.
2) Input validation error (CVE-ID: CVE-2025-6558)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in ANGLE and GPU. A remote attacker can trick the victim into opening a specially crafted web page and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.
3) Use after free (CVE-ID: CVE-2025-43216)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and crash the browser.
4) Out-of-bounds read (CVE-ID: CVE-2025-43265)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds read error and read contents of memory on the system.
5) Memory corruption (CVE-ID: CVE-2025-43211)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
6) Memory corruption (CVE-ID: CVE-2025-43212)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
7) Memory corruption (CVE-ID: CVE-2025-43213)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
8) Memory corruption (CVE-ID: CVE-2025-43214)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
9) Buffer overflow (CVE-ID: CVE-2025-31273)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
10) Buffer overflow (CVE-ID: CVE-2025-31277)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
11) Buffer overflow (CVE-ID: CVE-2025-31278)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
12) Memory corruption (CVE-ID: CVE-2025-31281)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file and perform unexpected app termination.
13) Memory corruption (CVE-ID: CVE-2025-43186)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in afclip. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected app termination.
14) Memory corruption (CVE-ID: CVE-2025-43221)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and execute arbitrary code on the system.
15) Memory corruption (CVE-ID: CVE-2025-43224)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary error in Model I/O. A remote attacker can trick the victim into opening a specially crafted file, trigger memory corruption and execute arbitrary code on the system.
16) Improper input validation (CVE-ID: CVE-2025-43234)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in Metal. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
17) Type confusion (CVE-ID: CVE-2025-7424)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in xmlNode.psvi. A remote attacker can pass specially crafted XML input to the application, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
18) Use-after-free (CVE-ID: CVE-2025-7425)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the xsltSetSourceNodeFlags() function. A remote attacker can pass specially crafted XML input to the application, trigger memory corruption and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
19) Improper input validation (CVE-ID: CVE-2025-43226)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
20) Memory corruption (CVE-ID: CVE-2025-43209)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ICU. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.
21) Improper access control (CVE-ID: CVE-2025-43230)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in CoreMedia Playback. A local application can access user-sensitive data.
22) Memory corruption (CVE-ID: CVE-2025-43210)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
23) Buffer overflow (CVE-ID: CVE-2025-43277)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in CoreAudio when processing media files. A remote attacker can create a specially crafted media file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
24) Improper input validation (CVE-ID: CVE-2025-43223)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in CFNetwork. A local user can modify restricted network settings.
25) Resource management error (CVE-ID: CVE-2025-43282)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the OS kernel. A local application can cause unexpected system termination.
26) Buffer overflow (CVE-ID: CVE-2025-6965)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing aggregated terms. A remote attacker can pass specially crafted input to the application where the number of aggregate terms exceeds the number of columns available, trigger memory corruption and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.