CVE-2025-43520

Known exploited (listed in CISA KEV after the first fix).

Export this CVE's branch rows: CSV · JSON · Permalink: /cve/CVE-2025-43520

First fix

2025-11-03 (iOS 26.1 and iPadOS 26.1, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1)

CISA KEV added

2026-03-20 (137 days after the first fix)

NVD published

2025-12-12 (39 days after the first fix)

First fix: The release date of the earliest Apple update (including Rapid Security Responses and Background Security Improvements) whose advisory lists the CVE.

KEV date added (proxy): CISA KEV “date added” is when CISA catalogued evidence of exploitation. It is a lagging proxy: exploitation started on or before that date, usually well before.

Fix per branch

Backport gap: For one CVE and one branch: the branch's first fix date minus the earliest fix date across all branches of the same platform.

No fix listed: The branch is still maintained (it shipped a security update after the earliest fix, or its last security update is under 180 days old), but no Apple advisory lists this CVE for it as of the data date. The branch may be unaffected; Apple does not publish “not affected” statements.

Branch ended: The branch shipped no security update after the earliest fix and none in the 180 days before the data date, so it is treated as ended and not counted as missing a backport. Updates without published CVE entries do not keep a branch alive.

Fixed at branch release: The branch was first released after the earliest fix, so it is not a backport and is not counted. “Listed”: its advisory names the CVE. “Inherited”: it does not, and the fix is assumed to be in the branch from its first release.

Every Apple listing

Each release whose advisory lists CVE-2025-43520, with Apple's own notes.