CVE-2025-43365
📋 TL;DR
An unprivileged process can terminate root processes on iOS and iPadOS devices due to improper input validation, causing denial-of-service. This affects users running iOS/iPadOS versions before 18.7.2. The vulnerability requires local access to the device.
💻 Affected Systems
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
Critical system processes could be terminated, causing device instability, crashes, or persistent denial-of-service requiring reboot.
Likely Case
Limited denial-of-service affecting specific applications or services, potentially disrupting device functionality temporarily.
If Mitigated
Minimal impact with proper access controls and monitoring in place.
🎯 Exploit Status
Requires local process execution. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 18.7.2 and iPadOS 18.7.2
Vendor Advisory: https://support.apple.com/en-us/125633
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Tap General. 3. Tap Software Update. 4. Download and install iOS 18.7.2 or iPadOS 18.7.2. 5. Restart device when prompted.
🔧 Temporary Workarounds
Restrict app installations
allOnly install apps from trusted sources and limit app permissions
Monitor process termination
allImplement monitoring for unexpected process termination events
🧯 If You Can't Patch
- Implement strict application control policies to limit what can run on devices
- Monitor for unusual process termination patterns and investigate anomalies
🔍 How to Verify
Check if Vulnerable:
Check iOS/iPadOS version in Settings > General > About > Software VersionCheck Version:
Not applicable - check via device Settings interfaceVerify Fix Applied:
Verify version shows iOS 18.7.2 or iPadOS 18.7.2 or later📡 Detection & Monitoring
Log Indicators:
- Unexpected process termination events
- System logs showing privilege escalation attempts
Network Indicators:
- None - local vulnerability only
SIEM Query:
Search for process termination events from non-privileged users/apps targeting system processes