# Apple products vulnerable to arbitrary code execution

Published: 2026-06-09 · Severity: elevated · Sectors: technology
Canonical: https://vorant.io/reports/69ebc2cc-28dd-57f0-8df4-fa6bb507c09c/apple-products-vulnerable-to-arbitrary-code-execution

> Apple released patches for multiple critical vulnerabilities affecting iOS, macOS, Safari, and other products; no active exploitation reported.

A CIS-ISAC advisory documents multiple vulnerabilities across Apple's product line, with the most severe enabling arbitrary code execution in the context of the logged-on user. The affected products span iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, macOS Tahoe, Safari 26.1, Xcode 26.1, watchOS 26.1, tvOS 26.1, and visionOS 26.1. Vulnerabilities range from privilege escalation via sudo misconfiguration (CVE-2025-32462) to memory corruption from malicious web content and media files, sandbox escapes, and data exfiltration. The advisory notes no active exploitation in the wild at time of publication.

The vulnerability set encompasses multiple attack vectors: processing malicious web content or media files can corrupt memory, certain configurations allow privilege escalation to root, and several issues permit sandbox breakout and access to sensitive user data. Additional vulnerabilities enable address-bar spoofing, privacy-preference bypass, keystroke monitoring without permission, and physical-access attacks against locked devices. The impact depends on user privilege level; administrative users face greater risk. Apple has issued patches across all affected versions and CIS-ISAC recommends immediate patching after testing, alongside implementation of least-privilege principles, application allowlisting, and endpoint detection and prevention controls.

## Mentioned in this report

- Vulnerabilities: CVE-2025-30465, CVE-2025-32462 (weaponized), CVE-2025-43338, CVE-2025-43361, CVE-2025-43364, CVE-2025-43372, CVE-2025-43373, CVE-2025-43383, CVE-2025-43384, CVE-2025-43385, CVE-2025-43386, CVE-2025-43387, CVE-2025-43393, CVE-2025-43407, CVE-2025-43412, CVE-2025-43422, CVE-2025-43423, CVE-2025-43431, CVE-2025-43433, CVE-2025-43445, CVE-2025-43447, CVE-2025-43448, CVE-2025-43459, CVE-2025-43462, CVE-2025-43467, CVE-2025-43472, CVE-2025-43476, CVE-2025-43480, CVE-2025-43481, CVE-2025-43493, CVE-2025-43495, CVE-2025-43497, CVE-2025-43502, CVE-2025-43503, CVE-2025-43504, CVE-2025-43505

## Detection guidance (public sample)

### Sudo Invoked with Remote Host Option (CVE-2025-32462 Abuse)

ATT&CK: T1548.003

Detects sudo run with the -h/--host option followed by a host argument on Linux. This is the pattern used to abuse the sudoers host-matching flaw CVE-2025-32462 for privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Sudo Invoked with Remote Host Option (CVE-2025-32462 Abuse)
description: Detects sudo executed with the -h or --host option and a host argument
  on Linux. Abuse of this option can bypass host-restricted sudoers rules (CVE-2025-32462).
  Plain 'sudo -h' (help) has no argument and is not matched.
tags:
- attack.privilege-escalation
- attack.t1548.003
- cve.2025-32462
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /sudo
    CommandLine|contains:
    - ' -h '
    - ' --host='
    - ' --host '
  filter_help:
    CommandLine|contains: ' --help'
  condition: selection and not filter_help
falsepositives:
- Administrators deliberately testing host-scoped sudoers rules with sudo -l -h
- Configuration management tooling that audits sudoers for other hosts
level: medium
id: bd478ec5-4444-5e92-8ba1-fd442bbb8fd6
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2025-102
```

### Sudo Invoked with Remote Host Option on macOS (CVE-2025-32462 Abuse)

ATT&CK: T1548.003

Detects sudo run with the -h/--host option followed by a host argument on macOS. This is the pattern used to abuse the sudoers host-matching flaw CVE-2025-32462. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Sudo Invoked with Remote Host Option on macOS (CVE-2025-32462 Abuse)
description: Detects sudo executed with the -h or --host option and a host argument
  on macOS. Abuse of this option can bypass host-restricted sudoers rules (CVE-2025-32462).
  Plain 'sudo -h' (help) has no argument and is not matched.
tags:
- attack.privilege-escalation
- attack.t1548.003
- cve.2025-32462
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /sudo
    CommandLine|contains:
    - ' -h '
    - ' --host='
    - ' --host '
  filter_help:
    CommandLine|contains: ' --help'
  condition: selection and not filter_help
falsepositives:
- Administrators deliberately testing host-scoped sudoers rules with sudo -l -h
- Enterprise management scripts that query sudo privileges for other hosts
level: medium
id: 50910abd-40b1-5a92-9b47-82cfd0310549
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2025-102
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2025-102

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/69ebc2cc-28dd-57f0-8df4-fa6bb507c09c/apple-products-vulnerable-to-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup