SB2025073152 - Multiple vulnerabilities in Apple iPadOS 17
Published: July 31, 2025 Updated: October 16, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 19 secuirty vulnerabilities.
1) Type confusion (CVE-ID: CVE-2025-7424)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in xmlNode.psvi. A remote attacker can pass specially crafted XML input to the application, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Input validation error (CVE-ID: CVE-2025-6558)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in ANGLE and GPU. A remote attacker can trick the victim into opening a specially crafted web page and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.
3) Use after free (CVE-ID: CVE-2025-43216)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted website and crash the browser.
4) Memory corruption (CVE-ID: CVE-2025-43211)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
5) Buffer overflow (CVE-ID: CVE-2025-31278)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-24220)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in Sandbox Profiles. A local application can read a persistent device identifier.
7) Information exposure through log files (CVE-ID: CVE-2025-43225)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to inclusion of sensitive information into a log file in Notes. A local application can access sensitive user data.
8) Information disclosure (CVE-ID: CVE-2025-31276)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to Mail Drafts can load remote content when the 'Load Remote Images' setting is turned off. A remote attacker can gain unauthorized access to sensitive information.
9) Input validation error (CVE-ID: CVE-2025-24224)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the OS kernel. A local application can perform a denial of service (DoS) attack.
10) Multiple Interpretations of UI Input (CVE-ID: CVE-2025-43217)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to privacy Indicators for microphone or camera access may not be correctly displayed. A remote attacker can trick the victim into sharing sensitive information with a third-party.
11) Improper input validation (CVE-ID: CVE-2025-43226)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient input validation in ImageIO. A remote attacker can trick the victim into opening a specially crafted file and gain access to sensitive information.
12) Memory corruption (CVE-ID: CVE-2025-43209)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ICU. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.
13) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-31279)
The vulnerability allows a local application to fingerprint the user.
The vulnerability exists due to improperly imposed security restrictions in Find My feature. A local application can gain access to sensitive information.
14) Improper access control (CVE-ID: CVE-2025-43230)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper access restrictions in CoreMedia Playback. A local application can access user-sensitive data.
15) Memory corruption (CVE-ID: CVE-2025-43210)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error in CoreMedia. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.
16) Improper link resolution before file access ('link following') (CVE-ID: CVE-2025-43220)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to insecure symbolic link following in copyfile. A local application can access protected user data.
17) Improper input validation (CVE-ID: CVE-2025-43223)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient input validation in CFNetwork. A local user can modify restricted network settings.
18) Use-after-free (CVE-ID: CVE-2025-43222)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in the CFNetwork component. A remote attacker can send specially crafted data to the system and perform a denial of service (DoS) attack.
19) Resource management error (CVE-ID: CVE-2025-43282)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the OS kernel. A local application can cause unexpected system termination.
Remediation
Install update from vendor's website.