This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Apple fixes over 80 vulnerabilities

Apple fixes more than 80 vulnerabilities in its products. Selected ones are listed below; the remaining ones are described on the vendor's pages [1] and in the overview table at [2]. Products and their fixed versions: macOS - Tahoe 26 [3], Sequoia 15.7 [4], Sonoma 14.8 [5] iOS - 26 [6], 18.7 [7], 16.7.12 [8], 15.8.5 [9] iPadOS - 26 [6], 18.7 [7], 16.7.12 [8], 15.8.5 [9] tvOS - 26 [10] watchOS - 26 [11] visionOS - 26 [12] Safari - 26 [13] Xcode - 26 [14]

Apple macOS Sequoia, Sonoma, Tahoe, iOS, iPadOS - sandbox restriction bypass (CVE-2025-43358)
CVSS 8.8 (High)

In macOS Sequoia, Sonoma and Tahoe, iOS and iPadOS, an authenticated local attacker can bypass the sandbox restrictions of the Shortcuts app [15].

The vulnerability is present in products:

  • macOS; >=14, <14.8; >=15, <15.7;
  • iOS; >=18,<18.7;
  • iPadOS; >18, <18.7;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 15. 9. 2025.

Apple macOS Sequoia, Sonoma, Tahoe - privilege escalation (CVE-2025-43304)
CVSS 7.0 (High)

Due to a race condition vulnerability in the StorageKit component in macOS Sequoia, Sonoma and Tahoe, an authenticated local attacker can obtain root privileges [16].

The vulnerability is present in product:

  • macOS; >=14, <14.8; >=15, <15.7;

CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-43304 at cve.org, NVD
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') at cwe.mitre.org

The vulnerability was publicly disclosed 15. 9. 2025.

Apple macOS Sequoia, Sonoma, Tahoe - memory corruption (CVE-2025-43353)
CVSS 7.1 (High)

By parsing a malicious string in the Libinfo library in macOS Sequoia, Sonoma and Tahoe, an unauthenticated local attacker can corrupt memory (heap corruption) [17].

The vulnerability is present in product:

  • macOS; >=14, <14.8; >=15, <15.7;

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

More information:

The vulnerability was publicly disclosed 15. 9. 2025.

Apple iOS, iPadOS - information disclosure (CVE-2025-43362)
CVSS 7.5 (High)

Due to a flaw in the LaunchServices component in iOS and iPadOS, an unauthenticated remote attacker can monitor keystrokes (keylogging) without authorization [18].

The vulnerability is present in products:

  • iOS; >=18, <18.7;
  • iPadOS; >=18, <18.7;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 15. 9. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 18. 9. 2025.

CESNET, z.s.p.o. Logo