CVE-2025-43520: 
macOS vulnerability analysis and mitigation

CVE-2025-43520 is a memory corruption vulnerability in Apple's kernel affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. A malicious application can exploit improper memory handling to cause unexpected system termination or write to kernel memory. The vulnerability was disclosed by Apple on November 3–5, 2025, with CVE assignment published December 12, 2025. Affected versions include iOS/iPadOS prior to 18.7.2 and 26.1, macOS Sonoma prior to 14.8.2, macOS Sequoia prior to 15.7.2, macOS Tahoe prior to 26.1, tvOS/visionOS/watchOS prior to 26.1. It carries a CVSS v3.1 base score of 5.5 (Medium), though active exploitation in the DarkSword exploit chain significantly elevates its real-world risk (Apple Advisory iOS 18.7.2, Apple Advisory iOS 26.1).

The vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input / Classic Buffer Overflow) in Apple's kernel memory handling subsystem. A local application with low privileges can trigger an out-of-bounds write (CWE-787 was initially assigned but later removed) by exploiting insufficient bounds checking during memory operations, allowing it to corrupt kernel memory or cause a system crash. No user interaction is required, and the attack vector is local — meaning a malicious app installed on the device can trigger the flaw without any additional user action. The vulnerability was attributed to Apple internally and was added to the iOS 18.7.2, iOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, and other platform advisories as a late addition on December 12, 2025 (Apple Advisory iOS 26.1, Apple Advisory macOS Tahoe). Google's Threat Intelligence Group (GTIG) documented its use in the DarkSword exploit chain, which combines this flaw with other vulnerabilities for full device compromise (Google Cloud Blog).

Successful exploitation allows a malicious application to write arbitrary data to kernel memory or cause unexpected system termination (denial of service). In the context of the DarkSword exploit kit, this kernel-level write primitive is chained with other vulnerabilities — including WebKit flaws — to achieve full device takeover, enabling theft of personal data, cryptocurrency wallet credentials, and persistent surveillance capabilities. The impact spans all major Apple platforms (iPhone, iPad, Mac, Apple TV, Apple Watch, Apple Vision Pro), potentially affecting hundreds of millions of devices. Malware families including GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE have been documented leveraging this vulnerability as part of multi-stage attack chains (Google Cloud Blog, ThaiCERT).

1. Initial Access via Malicious App or Browser Exploit: The DarkSword chain typically begins with a WebKit vulnerability (e.g., CVE-2025-43529) triggered by luring the victim to a malicious or compromised legitimate website, delivering a JavaScript-based exploit payload without requiring a click beyond page load.
2. WebKit Sandbox Escape: The browser exploit achieves code execution within the WebKit renderer process. A secondary vulnerability is used to escape the WebKit sandbox, gaining access to a broader process context.
3. Kernel Memory Corruption via CVE-2025-43520: A malicious application or payload component exploits the buffer overflow in Apple's kernel memory handling to write controlled data to kernel memory, bypassing kernel integrity protections.
4. Privilege Escalation to Root/Kernel: The kernel write primitive is used to escalate privileges to root or kernel level, disabling security mitigations and enabling persistent access.
5. Payload Deployment: Malware families such as GHOSTKNIFE, GHOSTSABER, or GHOSTBLADE are deployed to exfiltrate personal data, cryptocurrency wallet credentials, contacts, messages, and location data, and to establish persistence on the device.
6. Data Exfiltration: Stolen data is transmitted to attacker-controlled infrastructure (Google Cloud Blog, Lookout, BleepingComputer).

• Network: Unexpected outbound connections from iOS/macOS devices to unknown or suspicious IP addresses/domains; traffic patterns consistent with data exfiltration (large uploads to unfamiliar endpoints); connections to known DarkSword C2 infrastructure.
• Process/Behavior: Unexpected system crashes or kernel panics (panic logs referencing memory corruption); unusual processes spawned with elevated privileges; apps exhibiting behavior inconsistent with their declared permissions (e.g., accessing contacts, location, or keychain without user prompt).
• File System: Presence of unknown or unsigned binaries in app containers or system directories; unexpected configuration profiles installed on the device; new persistence mechanisms (launch daemons, scheduled tasks) created by non-system processes.
• Logs: Kernel panic logs (/Library/Logs/DiagnosticReports/ on macOS, crash logs on iOS) referencing memory corruption or out-of-bounds writes; system logs showing repeated crashes of kernel-adjacent processes; crash reports for Safari or WebKit renderer processes preceding system-level anomalies.
• Indicators of Malware Families: Presence of GHOSTKNIFE, GHOSTSABER, or GHOSTBLADE artifacts as identified by SentinelOne and ThaiCERT threat intelligence; device behavior consistent with infostealer activity (bulk access to Photos, Contacts, Keychain) (SentinelOne, Lookout).

Apple has released patches across all affected platforms. Users should update immediately to: iOS 18.7.2 or iOS 26.1, iPadOS 18.7.2 or iPadOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1 (Apple Advisory iOS 18.7.2, Apple Advisory iOS 26.1). CISA mandated that U.S. federal agencies apply mitigations by April 3, 2026 under BOD 22-01 (CISA KEV). As a workaround prior to patching, restrict installation of untrusted or sideloaded applications, enable Lockdown Mode on high-risk iOS/iPadOS devices, and monitor for anomalous device behavior. No configuration-only mitigation fully addresses the vulnerability — patching is the only definitive remediation.

Google's Threat Intelligence Group (GTIG) published a detailed technical report on the DarkSword exploit chain in March 2026, attributing its use to state-sponsored actors and commercial spyware vendors and documenting its adoption by multiple threat actor groups (Google Cloud Blog). Lookout Security independently analyzed the DarkSword kit and published threat intelligence on the WebKit and kernel vulnerabilities involved (Lookout). BleepingComputer and The Hacker News covered CISA's emergency directive ordering federal agencies to patch, generating significant community attention (BleepingComputer, The Hacker News). SentinelOne highlighted the malware families (GHOSTKNIFE, GHOSTSABER) in their weekly threat roundup, and Apple subsequently expanded iOS 18 security updates to additional older iPhone models to broaden patch coverage against DarkSword attacks (SentinelOne). The security community broadly characterized the DarkSword chain as a sophisticated, state-level capability, with commentary noting it undermined the longstanding perception of iPhones as inherently secure devices.