Apple watchOS 26.1 Security Update: Vulnerability Summary (CVE-2025-43455, etc.)

Key Vulnerabilities Apple Account - CVE-2025-43455: Could allow sensitive information capture within embedded views. Fixed by improving checks. Apple Neural Engine - CVE-2025-43447: Could lead to unexpected system termination or kernel memory corruption. Fixed by improved memory handling. - CVE-2025-43462: Same as above. Fixed by improved memory handling. AppleMobileFileIntegrity - CVE-2025-43379: Could allow access to protected user data. Fixed by improving symbolic link validation. CloudKit - CVE-2025-43448: Could enable sandbox escape. Fixed by improving symbolic link validation. CoreServices - CVE-2025-43436: Could allow enumeration of user-installed apps. Fixed by adding extra restrictions. CoreText - CVE-2025-43445: Processing maliciously crafted media files could cause unexpected termination or process memory corruption. Fixed by improved input validation. Find My - CVE-2025-43507: Could enable user fingerprinting. Fixed by moving sensitive data to address privacy issue. FontParser - CVE-2025-43400: Processing maliciously crafted fonts could cause unexpected termination or process memory corruption. Fixed by improved boundary checking. Installer - CVE-2025-43444: Could enable user fingerprinting. Fixed by adding extra restrictions to address permission issue. Kernel - CVE-2025-43398: Could lead to unexpected system termination. Fixed by improved memory handling. libxpc - CVE-2025-43413: Sandboxed apps could observe system-wide network connections. Fixed by adding extra sandbox restrictions. Mail Drafts - CVE-2025-43496: Remote content could load even when remote images are disabled. Fixed by adding extra logic. MallocStackLogging - CVE-2025-43294: Issue in environment variable handling. Fixed by improved validation. Phone - CVE-2025-43459: Physical access to locked Apple Watch could allow viewing live voicemail. Fixed by improving state management. Safari - CVE-2025-43503: Visiting malicious websites could lead to UI spoofing. Fixed by improving state management to resolve inconsistent UI issues. Sandbox Profiles - CVE-2025-43500: Privacy issue allowing access to sensitive user data. Fixed by improving user preference handling. WebKit (multiple CVEs) - Web content processing could lead to unexpected termination, corruption, and other issues. Fixed by various improvements including memory handling and boundary checking. Release Date November 3, 2025 Acknowledgments Anonymous researchers and other contributors for reporting vulnerabilities and assisting in multiple modules.

Goal Reached Thanks to every supporter — we hit 100%!

Apple watchOS 26.1 Security Update: Vulnerability Summary (CVE-2025-43455, etc.)