Loading vulnerability…
CVE-2025-43510 is an Apple kernel memory corruption vulnerability affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple described the issue as a memory corruption flaw fixed through improved lock state checking, indicating a concurrency or synchronization defect in kernel memory management. Available reporting further characterizes it as an improper locking or copy-on-write issue in XNU that can cause unexpected changes in memory shared between processes. In exploit-chain analysis associated with DarkSword, the flaw was reportedly used after an initial sandbox escape to pivot from a constrained process into mediaplaybackd by building arbitrary function-call primitives, making it a useful sandbox-escape and post-exploitation primitive rather than a standalone remote entry point.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains three standalone Xcode iOS PoC apps plus CI packaging workflow and documentation. The primary purpose is security research and reproduction of Apple kernel/driver vulnerabilities reachable from a normal app context. Structure: UAFPoc/, AOPPanicPoc/, and M2ScalerPoC/ each contain a minimal Xcode project, Info.plist, and a single Objective-C main.m implementing the PoC logic. .github/workflows/build.yml builds unsigned IPAs for all three apps on macOS runners. README.md documents CVE-2026-28992 in detail and also references the AppleM2ScalerCSCDriver issues. Main exploit capabilities: 1) UAFPoc targets CVE-2026-28992 in IOHIDFamily FastPathUserClient. It crafts an XML property list containing FastPathHasEntitlement and FastPathMotionEventEntitlement to satisfy gate/open checks, opens 15 connections to IOHIDEventService, then races one thread repeatedly calling selector 1 (close) and selector 0 (reopen/gate) against eight threads repeatedly calling selector 2 (copyEvent) on other connections. The intended result is a provider-side use-after-free leading to kernel panic/reboot. 2) AOPPanicPoc also targets CVE-2026-28992 but exercises a different race: multiple persistent connections are gated, opener threads continuously close/reopen them, and the main thread repeatedly opens batches of probe connections and destroys their Mach ports with mach_port_destroy to trigger asynchronous didTerminate/teardown while other threads are reopening. The comments state this can free provider-facing state concurrently and saturate SPU/AOP mailbox handling, causing an AOP watchdog timeout and device reboot. 3) M2ScalerPoC targets AppleM2ScalerCSCDriver and appears to combine vulnerability research for CVE-2025-43510 and CVE-2026-43655. It opens the AppleM2ScalerCSCDriver service (trying userType 0 and 1), probes selectors 0-15 with zeroed input to map the attack surface, performs a boundary sweep for an alleged OOB read using crafted MultiPlaneDescriptor structures on methods 5-7, and then launches a COW race phase that may reboot the device. Unlike the IOHID PoCs, this one logs detailed output to Documents/poc_log.txt. No network C2, remote delivery, or exfiltration behavior is present. The attack vector is local-only: the code must run as an app on a vulnerable iOS device. The repository is a real exploit/PoC set rather than a detector; however, it is destructive in the sense that successful exploitation causes kernel panic and reboot rather than privilege escalation or shell access.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An iOS kernel memory management vulnerability used in the DarkSword iOS exploit chain.
One of six CVEs in the DarkSword iOS exploit chain affecting older iOS 18 devices and tracked by CISA as actively exploited.
One of six vulnerabilities leveraged by the DarkSword exploit kit targeting iPhones and iPads running iOS 18.x; significant because DarkSword is described as actively exploited and broadly deployed.
One of six iOS vulnerabilities used by the DarkSword exploit kit to target iPhones running iOS 18.4 through 18.7; Apple shipped fixes in security updates and later expanded iOS 18.7.7 availability to protect more devices.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.