CVE-2025-43359

The vulnerability results from a logical error (CWE-670 — Always-Incorrect Control Flow Implementation) in UDP network socket state handling. When binding a UDP server socket to a specific local network interface, the state management error causes the socket to actually be bound to all available interfaces. As a result, network traffic directed to all device interfaces — including external or public ones — is accepted by the socket, which was supposed to handle only local communication.

An attacker with network access to the device can gain unauthorized access to UDP services that should be isolated locally, potentially leading to disclosure of sensitive data, system integrity violation, or disruption of its availability.

Systems should be updated to the following versions: iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Patches are available through Apple's system update mechanism and in the vendor references provided above.

iOS and iPadOS versions prior to 18.7, macOS Sequoia prior to 15.7, macOS Sonoma prior to 14.8, as well as versions preceding: iOS 26, iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26