CVE-2025-46302
📋 TL;DR
A buffer overflow vulnerability in macOS and iOS/iPadOS allows malicious HID devices to cause unexpected process crashes. This affects users of macOS Sequoia, Sonoma, iOS 18, and iPadOS 18 before specific patch versions. The vulnerability stems from improper bounds checking in HID device handling.
💻 Affected Systems
- macOS
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
Potential arbitrary code execution leading to full system compromise if combined with other vulnerabilities
Likely Case
Denial of service through process crashes when connecting malicious HID devices
If Mitigated
No impact with proper patching and physical security controls
🎯 Exploit Status
Requires physical access or social engineering to connect malicious HID device. No authentication bypass needed once device is connected.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, iOS 18.7.5, iPadOS 18.7.5
Vendor Advisory: https://support.apple.com/en-us/126347
Restart Required: Yes
Instructions:
1. Open System Settings > General > Software Update. 2. Install available updates. 3. Restart device when prompted.
🔧 Temporary Workarounds
Disable USB/HID device connections
macOSPrevent unauthorized HID devices from connecting via USB port restrictions
Use USB data blockers
allPhysical USB data blockers prevent data transfer while allowing charging
🧯 If You Can't Patch
- Implement strict physical security controls for USB ports
- Use endpoint protection software with USB device control features
🔍 How to Verify
Check if Vulnerable:
Check macOS version: System Settings > General > About. Check iOS/iPadOS version: Settings > General > AboutCheck Version:
macOS: sw_vers -productVersion, iOS/iPadOS: Settings > General > AboutVerify Fix Applied:
Verify version is macOS Sequoia 15.7.4+, Sonoma 14.8.4+, or iOS/iPadOS 18.7.5+📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes in system logs
- Kernel panic logs related to HID drivers
Network Indicators:
- None - this is a local physical attack vector
SIEM Query:
source="system.log" AND ("panic" OR "crash") AND ("HID" OR "USB")