Nine Apple vulnerabilities across iOS, iPadOS, macOS, Safari, tvOS, and watchOS were confirmed exploited over the past year — every one of them a memory-safety issue: use-after-free, memory corruption, integer overflow, or bounds-checking failures, the same small set of root causes repeating across nearly a decade of disclosure dates.
| CVE | CVSS | Root cause | Originally disclosed |
|---|---|---|---|
| CVE-2025-31277 | 8.8 | Memory handling | Recent |
| CVE-2023-43000 | 8.8 | Use-after-free | 2023 |
| CVE-2025-43529 | 8.8 | Use-after-free | Recent |
| CVE-2022-48503 | 8.8 | Bounds checking | 2022 |
| CVE-2021-30952 | 7.8 | Integer overflow | 2021 |
| CVE-2023-41974 | 7.8 | Use-after-free | 2023 |
| CVE-2025-43510 | 7.8 | Lock state / memory corruption | Recent |
| CVE-2026-20700 | 7.8 | State management / memory corruption | Recent |
| CVE-2025-43520 | 5.5 | Memory handling | Recent |
Why Apple's own advisory language is worth taking seriously despite its brevity
Apple's security bulletins are consistently terse — "addressed with improved memory handling," "addressed with improved bounds checks" — without the CWE classifications or detailed exploitation narratives NVD provides for many other vendors. That brevity doesn't mean these findings are minor; every one in this table was independently confirmed by CISA as actively exploited, and Apple's own historical pattern shows this level of disclosure detail is standard even for its most serious fixes, not a sign of reduced severity.
Why memory safety keeps producing Apple's confirmed-exploited findings specifically
Much of Apple's platform codebase, like most mature operating systems and browsers, is written substantially in memory-unsafe languages for historical and performance reasons — the same underlying reality driving the Linux kernel's persistent memory-safety findings discussed elsewhere in this series. Apple has invested significantly in memory-safe language adoption for newer code and in exploit-mitigation technology at the platform level, and this cluster is evidence that mitigation reduces but does not eliminate the risk — nine confirmed-exploited findings across a single year, spanning disclosure dates from 2021 to the present, describes an ongoing, structural category of risk rather than a solved problem.
What to check this week
Confirm every managed Apple device — iOS, iPadOS, macOS — is on a build incorporating all nine fixes, not just the most recent one, given how many of these span multiple OS generations and require checking against older, still-supported branches specifically.
Prioritize devices with any browser-reachable attack surface, since several of these findings describe exploitation via crafted web content — a vector requiring nothing more than visiting a malicious page.
Treat consumer-managed or BYOD Apple devices as a distinct compliance-tracking category, given the enforcement gap discussed elsewhere in this series for organizations without full MDM coverage across every Apple endpoint in use.
Why the spread of affected products matters for fleet tracking
This cluster touches iOS, iPadOS, macOS, Safari, tvOS, and watchOS individually, and many of the fixes shipped across several of these platforms simultaneously in a single coordinated update. An organization managing a mixed Apple device fleet — phones, tablets, laptops, and any deployed Apple TV or Watch hardware — needs patch tracking that spans the full device category list, not just the primary computer and phone platforms most MDM tooling defaults to monitoring most closely.
A closing note on Safari specifically
Because several of these findings are exploitable through crafted web content, and Safari remains the default and often only easily updatable browser on locked-down iOS deployments, verifying Safari's own update status specifically — separate from the underlying OS version — is worth doing rather than assuming an OS update always brings the browser along with it.
A final consideration on personal devices used for work
For organizations permitting personal Apple devices to access corporate resources without full MDM enrollment, this nine-CVE cluster is a concrete argument for requiring at minimum a verified minimum OS version as a condition of that access, rather than leaving patch currency entirely to individual device owners' own habits.
How Safeguard helps
Safeguard's continuous inventory tracks endpoint operating systems and browsers across the full range of versions an organization's device fleet actually runs, surfacing exactly the kind of multi-CVE, multi-generation patch gap this Apple cluster represents rather than relying on a general assumption of currency.
