This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Apple fixes more than 80 vulnerabilities in various products

Apple fixes more than 80 vulnerabilities in its products. Selected ones are listed below; the remaining ones are described at [1][2]. Products and their fixed versions: macOS - Sequoia 15.6 [3], Sonoma 14.7.7 [4], Ventura 13.7.7 [5] iOS - 18.6 [6] iPadOS - 18.6 [6], 17.7.9 [7] watchOS - 11.6 [8] tvOS - 18.6 [9] visionOS - 2.6 [10] Safari - 18.6 [11]

Apple macOS Sequoia, macOS Sonoma, macOS Ventura - protected filesystem modification (CVE-2025-43194)
CVSS 9.8 (Critical)

An unauthenticated remote attacker, due to insufficient input validation in the PackageKit component in macOS Sequoia, Sonoma and Ventura, is able to modify protected parts of the file system [12].

The vulnerability is present in product:

  • macOS; <13.7.7; >=14.0, <14.7.7; >=15.0, <15.6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 29. 8. 2025.

Apple macOS Sequoia, macOS Sonoma - privilege escalation (CVE-2025-43256)
CVSS 8.8 (High)

An unauthenticated remote attacker, due to insufficient state management in the StorageKit component in macOS Sequoia and Sonoma, is able to gain root privileges by means of a malicious application [13].

The vulnerability is present in product:

  • macOS; >=14.0, <14.7.7; >=15.0, <15.6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 29. 8. 2025.

Apple macOS Sequoia, Safari, iOS, iPadOS, watchOS, tvOS, visionOS - memory corruption (CVE-2025-31278)
CVSS 7.1 (High)

An unauthenticated remote attacker, due to improper memory handling in the WebKit component in macOS Sequoia, Safari, iOS, iPadOS, watchOS, tvOS and visionOS, is able to corrupt data in memory by means of social engineering and a specially crafted web page [14].

The vulnerability is present in products:

  • Safari; <18.6;
  • iPadOS; <17.7.9; >=18.0, <18.6;
  • iOS; <18.6;
  • macOS; >=15.0, <15.6;
  • tvOS; <18.6;
  • visionOS; <2.6;
  • watchOS; <11.6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

More information:

  • CVE-2025-31278 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 29. 8. 2025.

Apple iOS, iPadOS - sensitive information disclosure (CVE-2025-31276)
CVSS 5.3 (Medium)

An unauthenticated remote attacker, due to insufficient state management in iOS and iPadOS, is able to load remote content in a user's email draft (Mail Draft), even though the user has the "Load Remote Images" option turned off [15].

The vulnerability is present in products:

  • iPadOS; <17.7.9; >=18.0, <18.6;
  • iOS; <18.6;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 29. 8. 2025.

Apple macOS Sequoia, macOS Sonoma, macOS Ventura - sensitive information disclosure (CVE-2025-43259)
CVSS 4.6 (Medium)

An unauthenticated attacker with physical access to a locked device, due to insufficient redaction of sensitive data in the WindowServer component in macOS Sequoia, Sonoma and Ventura, is able to view this information [16].

The vulnerability is present in product:

  • macOS Sequoia; <13.7.7; >=14.0, <14.7.7; >=15.0, <15.6;

CVSS: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 29. 8. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 1. 8. 2025.

CESNET, z.s.p.o. Logo