CVE-2025-43424 | ByteOS Network

Vulnerability Details :

CVE-2025-43424

Assigner-apple

Assigner Org ID-286789f9-fbc2-4510-9f9a-43facdede74c

Published At-04 Nov, 2025 | 01:15

Updated At-17 Dec, 2025 | 20:46

The issue was addressed with improved bounds checks. This issue is fixed in macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1. A malicious HID device may cause an unexpected process crash.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:apple

Assigner Org ID:286789f9-fbc2-4510-9f9a-43facdede74c

Published At:04 Nov, 2025 | 01:15

Updated At:17 Dec, 2025 | 20:46

▼CVE Numbering Authority (CNA)

The issue was addressed with improved bounds checks. This issue is fixed in macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1. A malicious HID device may cause an unexpected process crash.

Affected Products

Vendor

Product

Versions

Affected

From unspecified before 26.1 (custom)

Vendor

Product

Versions

Affected

From unspecified before 26.1 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	A malicious HID device may cause an unexpected process crash

Type: N/A

CWE ID: N/A

Description: A malicious HID device may cause an unexpected process crash

References

Hyperlink	Resource
https://support.apple.com/en-us/125634	N/A
https://support.apple.com/en-us/125632	N/A

Hyperlink: https://support.apple.com/en-us/125634

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125632

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-119	CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Type: CWE

CWE ID: CWE-119

Description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Metrics

Version	Base score	Base severity	Vector
3.1	4.3	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:product-security@apple.com

Published At:04 Nov, 2025 | 02:15

Updated At:17 Dec, 2025 | 21:16

The issue was addressed with improved bounds checks. This issue is fixed in macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1. A malicious HID device may cause an unexpected process crash.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CPE Matches

>>ipados>>Versions before 26.1(exclusive)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

>>iphone_os>>Versions before 26.1(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-119	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-119

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://support.apple.com/en-us/125632	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/125634	product-security@apple.com	N/A

Hyperlink: https://support.apple.com/en-us/125632

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/125634

Source: product-security@apple.com

Resource: N/A

Similar CVEs

2347Records found

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-2.40% / 84.86%

||

7 Day CHG~0.00%

Published-27 Jun, 2006 | 22:00

Updated-03 Apr, 2025 | 01:03

Stack-based buffer overflow in ImageIO in Apple Mac OS X 10.4 up to 10.4.6 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image.

Vendor-n/a Apple Inc.

Product-mac_os_x_server mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.1||MEDIUM

EPSS-24.61% / 96.04%

||

7 Day CHG~0.00%

Published-12 May, 2006 | 20:00

Updated-03 Apr, 2025 | 01:03

Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT image format file with malformed image data.

Vendor-n/a Apple Inc.

Product-quicktime n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.97% / 76.41%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os tvos safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.79% / 73.60%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-CERT/CC

Matching Score-6

Assigner-CERT/CC

CVSS Score-7.5||HIGH

EPSS-63.97% / 98.41%

||

7 Day CHG~0.00%

Published-11 Jan, 2006 | 18:00

Updated-03 Apr, 2025 | 01:03

Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted (1) QuickTime Image File (QTIF), (2) PICT, or (3) JPEG format image with a long data field.

Vendor-n/a Apple Inc.

Product-quicktime n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-9.36% / 92.67%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "CoreAnimation" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption and application crash) via crafted data.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-23.40% / 95.88%

||

7 Day CHG~0.00%

Published-11 Nov, 2014 | 23:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0589.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-6.05% / 90.61%

||

7 Day CHG~0.00%

Published-10 Sep, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0551, CVE-2014-0552, and CVE-2014-0555.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-1.39% / 80.14%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.61% / 69.62%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-webkitgtk n/a Apple Inc.

Product-itunes tvos webkitgtk\+iphone_os icloud safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.53% / 90.14%

||

7 Day CHG~0.00%

Published-14 Mar, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable buffer overflow / underflow vulnerability in the Primetime TVSDK that supports customizing ad information. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.221 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-1.92% / 83.16%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the font manipulation functionality. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-4.83% / 89.37%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability when parsing a shape outline. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 25.0.0.127 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 46.83%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Sandbox" component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.02% / 5.58%

||

7 Day CHG~0.00%

Published-19 May, 2023 | 00:00

Updated-14 Mar, 2025 | 19:09

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Vendor-n/a LibTIFF Apple Inc.

Product-macos libtiff libtiff

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.5||HIGH

EPSS-0.60% / 69.33%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows attackers to cause a denial of service (memory corruption and application crash) by leveraging a window-close action during a debugger-pause state.

Vendor-n/a Apple Inc.

Product-iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.5||HIGH

EPSS-0.50% / 65.89%

||

7 Day CHG~0.00%

Published-20 Mar, 2025 | 23:53

Updated-03 Nov, 2025 | 20:16

The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.6, tvOS 17.6, Safari 17.6, macOS Sonoma 14.6, visionOS 1.3, iOS 17.6 and iPadOS 17.6. Processing web content may lead to a denial-of-service.

Vendor-Apple Inc.

Product-tvos macos watchos ipados visionos safari iphone_os Safari iOS and iPadOS tvOS visionOS watchOS macOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.79% / 73.60%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-4.29% / 88.70%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os tvos safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-13.05% / 93.99%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "Foundation" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted data.

Vendor-n/a Apple Inc.

Product-iphone_os tvos watchos mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-10.03% / 92.97%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os tvos safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-8.26% / 92.11%

||

7 Day CHG~0.00%

Published-11 Aug, 2017 | 19:00

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Acrobat Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 38.32%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Multi-Touch" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.69%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "WindowServer" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.55% / 67.79%

||

7 Day CHG~0.00%

Published-13 Feb, 2009 | 00:00

Updated-07 Aug, 2024 | 04:17

The Remote Apple Events server in Apple Mac OS X 10.4.11 and 10.5.6 does not properly initialize a buffer, which allows remote attackers to read portions of memory.

Vendor-n/a Apple Inc.

Product-mac_os_x_server mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.05% / 83.67%

||

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion module when processing a TIFF image. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 38.32%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "IOATAFamily" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-4.12% / 88.46%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os tvos safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-3.89% / 88.09%

||

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the image conversion engine, related to parsing of color profile metadata. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.23% / 84.31%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable heap overflow vulnerability in JPEG 2000 parsing of the fragment list tag. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-1.94% / 83.22%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the JavaScript engine, related to string manipulation. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.83% / 74.32%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "libxslt" component. It allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-7.03% / 91.36%

||

7 Day CHG~0.00%

Published-10 Apr, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1380.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-2.53% / 85.23%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-9.8||CRITICAL

EPSS-53.86% / 97.96%

||

7 Day CHG~0.00%

Published-20 Jun, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the MPEG-4 AVC module. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 25.0.0.171 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.69%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Multi-Touch" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-3.3||LOW

EPSS-1.99% / 83.43%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerability in the weblink module.

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.69%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "WindowServer" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.65% / 70.53%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Keyboards" component. A buffer overflow allows attackers to execute arbitrary code in a privileged context via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os tvos watchos mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-6.82% / 91.21%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-webkitgtk n/a Apple Inc.

Product-tvos webkitgtk\+iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.38% / 84.79%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the image conversion module, related to processing of TIFF files. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-1.92% / 83.16%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the AES module. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-10||HIGH

EPSS-6.04% / 90.60%

||

7 Day CHG~0.00%

Published-21 Aug, 2012 | 23:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.183.23 and 11.x before 11.4.402.265 on Windows and Mac OS X, before 10.3.183.23 and 11.x before 11.2.202.238 on Linux, before 11.1.111.16 on Android 2.x and 3.x, and before 11.1.115.17 on Android 4.x; Adobe AIR before 3.4.0.2540; and Adobe AIR SDK before 3.4.0.2540 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-4163 and CVE-2012-4164.

Vendor-n/a Microsoft Corporation Google LLC Adobe Inc.Apple Inc.Linux Kernel Organization, Inc

Product-air android air_sdk flash_player windows mac_os_x linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.11% / 83.88%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the renderer functionality. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.04% / 12.17%

||

7 Day CHG~0.00%

Published-11 Feb, 2026 | 22:59

Updated-12 Feb, 2026 | 22:03

The issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26.3, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3, Safari 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.

Vendor-Apple Inc.

Product-visionos ipados iphone_os safari macos Safari macOS visionOS iOS and iPadOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-416

Use After Free

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-2.83% / 85.98%

||

7 Day CHG~0.00%

Published-25 Jul, 2012 | 20:00

Updated-11 Apr, 2025 | 00:51

WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

Vendor-n/a Apple Inc.

Product-safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.6||MEDIUM

EPSS-0.07% / 22.45%

||

7 Day CHG~0.00%

Published-20 Sep, 2012 | 21:00

Updated-11 Apr, 2025 | 00:51

Apple Mac OS X before 10.7.5 does not properly handle the bNbrPorts field of a USB hub descriptor, which allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) by attaching a USB device.

Vendor-n/a Apple Inc.

Product-mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-1.63% / 81.67%

||

7 Day CHG~0.00%

Published-25 Jul, 2012 | 20:00

Updated-11 Apr, 2025 | 00:51

WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

Vendor-n/a Apple Inc.

Product-safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-4.29% / 88.70%

||

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os tvos safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-56.12% / 98.06%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 04:54

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer