SB2025091766 - Multiple vulnerabilities in Apple tvOS
Published: September 17, 2025 Updated: November 4, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 22 secuirty vulnerabilities.
1) Memory corruption (CVE-ID: CVE-2025-43355)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in MobileStorageMounter. A local application can cause a denial-of-service.
2) Improper access control (CVE-ID: CVE-2025-43342)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper access restrictions in WebKit. A remote attacker can trick the victim into opening a specially crafted website and crash the browser.
3) Memory corruption (CVE-ID: CVE-2025-43343)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and crash the browser.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-43356)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to missing permissions checks. A remote attacker can trick the victim into visiting a specially crafted website and gain access to sensor information without user consent.
5) Input validation error (CVE-ID: CVE-2025-43347)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the System component. A local application can perform a denial of service (DoS) attack.
6) Buffer overflow (CVE-ID: CVE-2025-6965)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing aggregated terms. A remote attacker can pass specially crafted input to the application where the number of aggregate terms exceeds the number of columns available, trigger memory corruption and perform a denial of service (DoS) attack.
7) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43329)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in Sandbox. A local application can break out of its sandbox.
8) State Issues (CVE-ID: CVE-2025-43359)
The vulnerability allows a remote attacker to gain unauthorized access to the system.
The vulnerability exists due to a log error within the OS kernel. A UDP server socket bound to a local interface may become bound to all interfaces exposing services on the Internet.
9) Memory corruption (CVE-ID: CVE-2025-43344)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Apple Neural Engine. A local application can cause unexpected system termination.
10) State issues (CVE-ID: CVE-2025-31255)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a state management issue in IOKit. A local application can access sensitive user data.
11) Out-of-bounds write (CVE-ID: CVE-2025-43302)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in IOHIDFamily. A local application can cause unexpected system termination.
12) Improper input validation (CVE-ID: CVE-2025-43372)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
13) Out-of-bounds write (CVE-ID: CVE-2025-43349)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write in CoreAudio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination.
14) Information exposure through log files (CVE-ID: CVE-2025-43303)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Bluetooth. A local application can access sensitive user data.
15) Information exposure through log files (CVE-ID: CVE-2025-43354)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Bluetooth. A local application can access sensitive user data.
16) Memory corruption (CVE-ID: CVE-2025-43346)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in Audio. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
17) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43317)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in AppleMobileFileIntegrity. A local application can access sensitive user data.
18) Out-of-bounds read (CVE-ID: CVE-2025-43361)
The vulnerability allows a local application to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the Audio subsystem. A local application can trigger an out-of-bounds read error and read contents of kernel memory.
19) Improper access control (CVE-ID: CVE-2025-43323)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in CloudKit. A local application can fingerprint the user.
20) Improper access control (CVE-ID: CVE-2025-43345)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in Kernel. A local application can access sensitive user data.
21) Buffer overflow (CVE-ID: CVE-2025-43419)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
22) Information disclosure (CVE-ID: CVE-2025-43376)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a logic issue in WebKit. A remote attacker can view leaked DNS queries with Private Relay turned on.
Remediation
Install update from vendor's website.