site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-29-2025-8 visionOS 2.6 visionOS 2.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/124154. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. afclip Available for: Apple Vision Pro Impact: Parsing a file may lead to an unexpected app termination Description: The issue was addressed with improved memory handling. CVE-2025-43186: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CFNetwork Available for: Apple Vision Pro Impact: A non-privileged user may be able to modify restricted network settings Description: A denial-of-service issue was addressed with improved input validation. CVE-2025-43223: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs CoreAudio Available for: Apple Vision Pro Impact: Processing a maliciously crafted audio file may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2025-43277: Google's Threat Analysis Group CoreMedia Available for: Apple Vision Pro Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2025-43210: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreMedia Playback Available for: Apple Vision Pro Impact: An app may be able to access user-sensitive data Description: The issue was addressed with additional permissions checks. CVE-2025-43230: Chi Yuan Chang of ZUSO ART and taikosoup ICU Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2025-43209: Gary Kwong working with Trend Micro Zero Day Initiative ImageIO Available for: Apple Vision Pro Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2025-43226 libxml2 Available for: Apple Vision Pro Impact: Processing a file may lead to memory corruption Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-7425: Sergei Glazunov of Google Project Zero libxslt Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may lead to memory corruption Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-7424: Ivan Fratric of Google Project Zero Metal Available for: Apple Vision Pro Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: Multiple memory corruption issues were addressed with improved input validation. CVE-2025-43234: Vlad Stolyarov of Google's Threat Analysis Group Model I/O Available for: Apple Vision Pro Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2025-43224: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative CVE-2025-43221: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative Model I/O Available for: Apple Vision Pro Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An input validation issue was addressed with improved memory handling. CVE-2025-31281: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative WebKit Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may disclose sensitive user information Description: This issue was addressed through improved state management. WebKit Bugzilla: 292888 CVE-2025-43227: Gilad Moav WebKit Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 291742 CVE-2025-31278: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei WebKit Bugzilla: 291745 CVE-2025-31277: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei WebKit Bugzilla: 293579 CVE-2025-31273: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei WebKit Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 292599 CVE-2025-43214: shandikri working with Trend Micro Zero Day Initiative, Google V8 Security Team WebKit Bugzilla: 292621 CVE-2025-43213: Google V8 Security Team WebKit Bugzilla: 293197 CVE-2025-43212: Nan Wang (@eternalsakura13) and Ziling Chen WebKit Available for: Apple Vision Pro Impact: Processing web content may lead to a denial-of-service Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 293730 CVE-2025-43211: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei WebKit Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may disclose internal states of the app Description: An out-of-bounds read was addressed with improved input validation. WebKit Bugzilla: 294182 CVE-2025-43265: HexRabbit (@h3xr4bb1t) from DEVCORE Research Team WebKit Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 295382 CVE-2025-43216: Ignacio Sanmillan (@ulexec) WebKit Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. WebKit Bugzilla: 296459 CVE-2025-6558: Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group Additional recognition Bluetooth We would like to acknowledge LIdong LI, Xiao Wang, Shao Dong Chen, and Chao Tan of Source Guard for their assistance. CoreAudio We would like to acknowledge Noah Weinberg for their assistance. Device Management We would like to acknowledge Al Karak for their assistance. libxml2 We would like to acknowledge Sergei Glazunov of Google Project Zero for their assistance. libxslt We would like to acknowledge Ivan Fratric of Google Project Zero for their assistance. Shortcuts We would like to acknowledge Dennis Kniep for their assistance. WebKit We would like to acknowledge Google V8 Security Team, Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei, rheza (@ginggilBesel) for their assistance. Instructions on how to update visionOS are available at https://support.apple.com/118481. To check the software version on your Apple Vision Pro, open the Settings app and choose General > About. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmiJVwgACgkQX+5d1TXa IvomUhAAljrfhsKA9HjoEhFoYKGueOSrX4rIKUauyHwlejGk1DxWXKUAZxD+IJS4 LV36z1WLBORP7DObmyhqcezCP1t1zqfOn+g0WOT5+bTjH8G7Drhi0cQbaRkx8s4b tj3R8+6mW8+LVP+NU+ZPfkzxl31VnTqe0ldQ5wgH9HyPrlJdV+bzS/01jLZ3BnlN cH+2aTipsDWv45qxE5e+Khwg23iyql4dtsMy7Lm3RqVSQYlix7QBxBUD5EsLyNCE Xb89/yxMTAnC7SgQHIUkpLlklQMlYuMcFDhzxUIrTHpqUSKHWHqBN8PFrqv35lho hq3IXapEMxLEFewBVNi5JQ3SJHWogD9+QP1e6nEiNNYQ+FDu7kIpAEnElT3DorZH H7+mBwzu7zOoEKva+lB1vpQD/fea055PFg1f+0UTHEyYHpQjyrZU812j5eydlLrm JCplU5OPdeAl+ffF62kLhux0l1gMnpNzCmPdS5jv90/VFL5u8/nPnGAP4jNyAjlJ Wn2xourm2qZDATxpqMs+GuBN/eYkr4ydK3X/Aku3H1mC8nMKTaJg3BYO7Z1v0//V 0RpKLMgyLooKbjtH4aeVfkkP43biuUCrNsdx/53JNRu/nXjOcnJugKFUj42iho3q IgrS0R4qVNyQ+d3ksCfEdgIxIohx7fkW6Yo9h+YHCbd9nxBz2OE= =CGv2 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com