CVE-2025-46304
📋 TL;DR
This vulnerability allows a malicious HID (Human Interface Device) like a keyboard or mouse to cause unexpected process crashes on affected Apple devices. It affects macOS, iOS, and iPadOS users who connect untrusted USB or Bluetooth input devices. The issue stems from insufficient bounds checking that can be exploited through specially crafted HID input.
💻 Affected Systems
- macOS
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
A malicious HID device could cause critical system processes to crash, potentially leading to denial of service, data loss, or system instability requiring reboot.
Likely Case
Most probable impact is application or process crashes when using malicious or compromised input devices, disrupting user workflow but not enabling full system compromise.
If Mitigated
With proper controls, impact is limited to temporary application disruption that can be resolved by disconnecting the malicious device and restarting affected applications.
🎯 Exploit Status
Exploitation requires physical access to connect a malicious HID device or Bluetooth pairing capability. No authentication bypass needed once device is connected.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Sequoia 15.7.4, iOS 18.7.5, iPadOS 18.7.5, macOS Sonoma 14.8.4
Vendor Advisory: https://support.apple.com/en-us/126347
Restart Required: No
Instructions:
1. Open System Settings > General > Software Update. 2. Install available updates. 3. For iOS/iPadOS: Settings > General > Software Update. 4. Install the security update.
🔧 Temporary Workarounds
Restrict Untrusted HID Devices
allPrevent connection of unknown USB or Bluetooth input devices through system policies or physical controls.
Disable Bluetooth When Not Needed
allTurn off Bluetooth to prevent malicious devices from pairing wirelessly.
🧯 If You Can't Patch
- Implement strict physical security controls for USB ports
- Use Bluetooth device whitelisting and require approval for new pairings
🔍 How to Verify
Check if Vulnerable:
Check current OS version against affected versions. For macOS: About This Mac > macOS version. For iOS/iPadOS: Settings > General > About > Version.Check Version:
macOS: sw_vers -productVersion; iOS/iPadOS: Not available via command line, check Settings > General > AboutVerify Fix Applied:
Verify OS version matches or exceeds patched versions: macOS Sequoia 15.7.4+, iOS 18.7.5+, iPadOS 18.7.5+, or macOS Sonoma 14.8.4+.📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes in system logs
- Console.app entries showing application termination
- Kernel panic logs if system crashes
Network Indicators:
- Bluetooth pairing attempts from unknown devices
- USB device connection events
SIEM Query:
source="system.log" AND ("panic" OR "crash" OR "terminated") AND process="WindowServer" OR process="loginwindow"