CVE-2025-43494

A mail header parsing issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An attacker may be able to cause a persistent denial-of-service.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/125632	Release Notes Vendor Advisory
https://support.apple.com/en-us/125633	Release Notes Vendor Advisory
https://support.apple.com/en-us/125634	Release Notes Vendor Advisory
https://support.apple.com/en-us/125635	Release Notes Vendor Advisory
https://support.apple.com/en-us/125636	Release Notes Vendor Advisory
https://support.apple.com/en-us/125638	Release Notes Vendor Advisory
https://support.apple.com/en-us/125639	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:ipados:26.0:::::::*
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:iphone_os:26.0:::::::*
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos:26.0:::::::*
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

History

02 Apr 2026, 19:20

Type	Values Removed	Values Added
Summary	(en) A mail header parsing issue was addressed with improved checks. This issue is fixed in watchOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Tahoe 26.1, visionOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, iOS 26.1 and iPadOS 26.1. An attacker may be able to cause a persistent denial-of-service.	(en) A mail header parsing issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An attacker may be able to cause a persistent denial-of-service.

16 Dec 2025, 18:36

Type	Values Removed	Values Added
First Time		Apple watchos Apple iphone Os Apple visionos Apple ipados Apple Apple macos
CPE		cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:macos:26.0:::::::* cpe:2.3:o:apple:watchos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:iphone_os:26.0:::::::* cpe:2.3:o:apple:ipados:26.0:::::::* cpe:2.3:o:apple:macos::::::::
References	~~() https://support.apple.com/en-us/125632 -~~	() https://support.apple.com/en-us/125632 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/125633 -~~	() https://support.apple.com/en-us/125633 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/125634 -~~	() https://support.apple.com/en-us/125634 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/125635 -~~	() https://support.apple.com/en-us/125635 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/125636 -~~	() https://support.apple.com/en-us/125636 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/125638 -~~	() https://support.apple.com/en-us/125638 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/125639 -~~	() https://support.apple.com/en-us/125639 - Release Notes, Vendor Advisory

15 Dec 2025, 15:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CWE		CWE-20

12 Dec 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-12 21:15

Updated : 2026-04-02 19:20

NVD link : CVE-2025-43494

Mitre link : CVE-2025-43494

CVE.ORG link : CVE-2025-43494

JSON object : View

Products Affected

apple

watchos
iphone_os
visionos
ipados
macos

CWE

CWE-20

Improper Input Validation

7.5 /10