CVE-2025-43359

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-43359
A logic issue was addressed with improved state management. This issue is fixed in tvOS 26, watchOS 26, macOS Sonoma 14.8, iOS 26 and iPadOS 26, macOS Sequoia 15.7, visionOS 26, iOS 18.7 and iPadOS 18.7. A UDP server socket bound to a local interface may become bound to all interfaces.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://support.apple.com/en-us/125108 Release Notes Vendor Advisory
https://support.apple.com/en-us/125109 Release Notes Vendor Advisory
https://support.apple.com/en-us/125111 Release Notes Vendor Advisory
https://support.apple.com/en-us/125112 Release Notes Vendor Advisory
https://support.apple.com/en-us/125114 Release Notes Vendor Advisory
https://support.apple.com/en-us/125115 Release Notes Vendor Advisory
https://support.apple.com/en-us/125116 Release Notes Vendor Advisory
http://seclists.org/fulldisclosure/2025/Sep/49
http://seclists.org/fulldisclosure/2025/Sep/53
http://seclists.org/fulldisclosure/2025/Sep/54
http://seclists.org/fulldisclosure/2025/Sep/55
http://seclists.org/fulldisclosure/2025/Sep/56
http://seclists.org/fulldisclosure/2025/Sep/57
http://seclists.org/fulldisclosure/2025/Sep/58
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
History

04 Nov 2025, 02:15

Type Values Removed Values Added
Summary (en) A logic issue was addressed with improved state management. This issue is fixed in tvOS 26, macOS Sonoma 14.8, macOS Sequoia 15.7, iOS 18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. A UDP server socket bound to a local interface may become bound to all interfaces. (en) A logic issue was addressed with improved state management. This issue is fixed in tvOS 26, watchOS 26, macOS Sonoma 14.8, iOS 26 and iPadOS 26, macOS Sequoia 15.7, visionOS 26, iOS 18.7 and iPadOS 18.7. A UDP server socket bound to a local interface may become bound to all interfaces.
References
  • {'url': 'https://support.apple.com/en-us/125110', 'tags': ['Release Notes', 'Vendor Advisory'], 'source': 'product-security@apple.com'}

03 Nov 2025, 19:16

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2025/Sep/49 -
  • () http://seclists.org/fulldisclosure/2025/Sep/53 -
  • () http://seclists.org/fulldisclosure/2025/Sep/54 -
  • () http://seclists.org/fulldisclosure/2025/Sep/55 -
  • () http://seclists.org/fulldisclosure/2025/Sep/56 -
  • () http://seclists.org/fulldisclosure/2025/Sep/57 -
  • () http://seclists.org/fulldisclosure/2025/Sep/58 -

17 Sep 2025, 13:59

Type Values Removed Values Added
First Time Apple ipados
Apple visionos
Apple macos
Apple tvos
Apple
Apple watchos
Apple iphone Os
References () https://support.apple.com/en-us/125108 - () https://support.apple.com/en-us/125108 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/125109 - () https://support.apple.com/en-us/125109 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/125110 - () https://support.apple.com/en-us/125110 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/125111 - () https://support.apple.com/en-us/125111 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/125112 - () https://support.apple.com/en-us/125112 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/125114 - () https://support.apple.com/en-us/125114 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/125115 - () https://support.apple.com/en-us/125115 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/125116 - () https://support.apple.com/en-us/125116 - Release Notes, Vendor Advisory
CPE cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*

16 Sep 2025, 18:15

Type Values Removed Values Added
CWE CWE-670
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

15 Sep 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-15 23:15

Updated : 2025-11-04 02:15

NVD link : CVE-2025-43359

Mitre link : CVE-2025-43359

CVE.ORG link : CVE-2025-43359

JSON object : View

Products Affected

apple

  • tvos
  • ipados
  • macos
  • watchos
  • iphone_os
  • visionos
CWE
CWE-670

Always-Incorrect Control Flow Implementation