Report · SANS ISC Handlers DiaryAbout CVE-2025-43400Published 29 Sep 2025

Apple Patches Single Vulnerability CVE-2025-43400, (Mon, Sep 29th)

Source SANS ISC Handlers Diary

Compare

Authoritative record:CVE-2025-43400· Medium 6.3

Not known to be exploited · CVSS 6.3 Medium.

Data as of 5 Nov 2026, 23:24 UTC

CVSS 3.1 base score

6.3Medium

How severe the flaw is on the 0–10 CVSS scale.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 29 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

European organizations should implement the following specific mitigation steps: 1) Prioritize deployment of Apple’s security updates for iOS 18 and 26, macOS Sonoma (14) and later, and visionOS 26 across all managed devices to close the vulnerability. 2) Conduct an inventory of Apple devices in use to ensure all affected versions are identified and updated promptly. 3) Employ endpoint management solutions capable of enforcing update policies and monitoring patch compliance on Apple devices. 4) Educate users to avoid opening untrusted font files or documents that may contain malicious fonts, especially from unknown sources or email attachments. 5) Monitor system logs and application crash reports for unusual behavior that may indicate exploitation attempts. 6) Integrate network-level protections to detect and block delivery of suspicious font files or payloads in email and web traffic. 7) Coordinate with Apple support and security advisories to stay informed about any emerging exploit reports or additional patches. 8) For organizations using visionOS devices, ensure updates are applied despite the lower profile of this platform. 9) Review and update incident response plans to include scenarios involving memory corruption or application crashes on Apple devices. 10) Consider deploying application whitelisting and sandboxing technologies to limit the impact of potential exploitation.

Description

Apple has released patches for a security vulnerability identified as CVE-2025-43400 affecting the Font Parser component across multiple versions of iOS, macOS, and visionOS. The flaw involves processing maliciously crafted fonts that may cause unexpected application termination or corrupt process memory. While remote code execution exploitation is not confirmed, the vulnerability poses risks to system stability and potential memory corruption. No known exploits have been reported in the wild so far. The vulnerability affects a broad range of Apple operating systems, including iOS 18 and 26, macOS Sonoma (14) and later, and visionOS 26. Updates for WatchOS and tvOS were released but do not address security issues. European organizations using Apple devices should prioritize patching to mitigate risks, especially those in sectors reliant on Apple ecosystems. Countries with high Apple device penetration and critical infrastructure using Apple products are more likely to be impacted. Given the medium severity and absence of confirmed remote code execution, the threat is assessed as medium but warrants timely remediation to prevent potential exploitation.

Impact

For European organizations, the vulnerability poses risks primarily related to application crashes and potential memory corruption on Apple devices. This can lead to denial of service conditions or, in worst-case scenarios, could be a stepping stone for more severe exploits such as remote code execution or privilege escalation if combined with other vulnerabilities. Organizations relying heavily on Apple ecosystems—such as enterprises using iPhones, iPads, Macs, and visionOS devices for critical business operations—may experience operational disruptions if exploited. The lack of known exploits reduces immediate risk but does not eliminate the threat, especially given the widespread use of Apple products in Europe. Sectors such as finance, healthcare, and government, which often use Apple devices for secure communications and operations, could face increased risk if attackers develop exploit code. Additionally, memory corruption vulnerabilities can be leveraged in sophisticated attack chains, making timely patching essential to maintain confidentiality, integrity, and availability of systems. The medium severity rating reflects moderate risk but underscores the importance of proactive mitigation to prevent escalation.

Summary

On September 29, 2025, Apple released security updates addressing a vulnerability tracked as CVE-2025-43400 affecting the Font Parser component in multiple Apple operating systems, including iOS 18 and 26, macOS versions back to Sonoma (14), and visionOS 26. The vulnerability arises from the improper handling of maliciously crafted fonts, which can lead to unexpected application termination or corruption of process memory. Although the exact exploitation vector remains unclear and remote code execution has not been confirmed, memory corruption vulnerabilities often carry risks of privilege escalation or arbitrary code execution if exploited. The flaw affects a wide range of Apple devices due to the shared Font Parser codebase across platforms. Apple’s typical post-major-release update pattern includes functional fixes and security patches, with this update being notable for addressing a security issue. No known exploits have been detected in the wild, indicating that attackers have not yet leveraged this vulnerability. The updates for WatchOS and tvOS do not address this security issue, suggesting these platforms are not affected. The vulnerability’s impact is primarily on application stability and memory integrity, which could be leveraged in targeted attacks if combined with other vulnerabilities. The broad affected version range necessitates patching across multiple Apple OS versions to ensure comprehensive protection.

References

isc.sans.edu/diary/rss/32330 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 7 Oct 2025, 01:36 UTC

Public exploits and detectionGitHub proofs of concept

References

Community reviews

Related threats