CVE-2025-43538
MediumCVSS 5.5Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive user data.
Risk Assessment
The vulnerability could allow a malicious app to access sensitive user data, potentially leading to privacy breaches.
Recommendation
Update iOS, iPadOS, macOS, visionOS, watchOS to the latest versions containing the fix.
Other vulnerabilities in Apple iOS
See all- CVE-2015-5882High
The processor_set_tasks API implementation in Apple iOS before version 9 allows local users to bypass an entitlement protection mechanism and gain access to the task ports of arbitrary processes by leveraging root privileges.
- CVE-2014-4451High
Apple iOS before 8.1.1 does not properly enforce the failed-passcode limit, making it easier for physically proximate attackers to bypass the lock-screen protection mechanism via a series of guesses.
- CVE-2013-5133High
Backup in Apple iOS before 7.1 does not properly restrict symlinks, allowing remote attackers to overwrite files during a restore operation via crafted backup data.
- CVE-2026-43814Critical
Memory management was improved to fix a use-after-free issue. An app may be able to cause unexpected system termination.
- CVE-2022-42827HighActively exploited
An out-of-bounds write issue in iOS and iPadOS. This issue is fixed in iOS 15.7.1, iPadOS 15.7.1, iOS 16.1, and iPadOS 16. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2020-9934MediumActively exploited
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
- CVE-2020-9818HighActively exploited
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.
- CVE-2020-9859HighActively exploited
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.
- CVE-2020-3837HighActively exploited
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
- CVE-2019-8605HighActively exploited
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.
Original NVD description (English source)
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive user data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS