CVE-2016-1825

No known exploitation. EPSS puts it in the 93rd percentile. A vendor fix is available.

CVSS 3.07.8High EPSS percentile93rd5.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2016-05-20Updated 2026-05-06Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Apple Mac Os XAffected: ≤ 10.11.4Upgrade to: after 10.11.4Stated by: NVD
Apple Inc. OS XAffected: до 10.11.5Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your Mac’s operating system version (Apple menu → About This Mac).
If your version is older than 10.11.5, upgrade macOS/OS X to 10.11.5 or newer.
If you cannot upgrade right away, avoid running untrusted or newly downloaded apps and treat unexpected app prompts/installers as suspicious until you patch.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

IOHIDFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

In plain language

Written by AI from the record

If you run macOS (OS X) older than 10.11.5, a specially crafted app could crash your Mac or possibly run code with higher privileges—this is uncommon, but you should update.

In Apple IOHIDFamily on OS X/macOS versions before 10.11.5, memory-corruption in how the system handles input device/app content can be triggered by a crafted app, leading to denial of service or privileged arbitrary code execution under local user interaction.

If you're affected

Mac system crashes
Elevated privilege compromise
Work interruption risk
Potential data theft

What is it

This is a bug in a core Apple component (IOHIDFamily) that helps the system work with input-related features. If a malicious, specially built app is opened, it can damage memory so the system crashes, and in the worst case it may let an attacker do more than a normal app is allowed to do.
Think of it like a vulnerable driver in your computer: most of the time it’s fine, but a booby-trapped program can use that weakness to cause trouble.

Who is affected

This matters to you if your business Macs are running Apple OS X/macOS before 10.11.5 and you open apps from untrusted sources. It’s not a remote “internet-only” problem based on these findings; it requires a user to interact with a crafted app.
So the risk is mainly for Macs that are kept unpatched and that run unknown or suspicious apps.

How urgent is it

Verdict: AMBER. There’s no public exploit code on record and it’s not listed in CISA KEV, but the vulnerability is high severity and involves memory corruption with the potential for privileged code execution.
Act by upgrading to 10.11.5 or newer—especially on any Mac that may run untrusted apps.

What to do — in detail

Confirm exposure on each Mac
- Open the Apple menu → “About This Mac”.
- Note the macOS/OS X version.
- If it is earlier than 10.11.5, you are in the affected range.
Upgrade (primary fix)
- Upgrade the OS to macOS/OS X 10.11.5 or newer using Apple’s update process.
- After updating, re-check “About This Mac” to confirm the version is updated.
If you can’t upgrade immediately (temporary containment)
- Only run apps from trusted sources.
- Avoid opening unexpected downloads, attachment files, or apps from emails/links where you don’t fully trust the sender.
- Use your normal internal process for app approvals (e.g., IT-managed software sources) until the OS patch is applied.
What to monitor
- If there are crashes or odd behavior shortly after opening new apps, prioritize removing/avoiding those apps and expedite the OS upgrade.
KEV / timing
- This CVE is not listed in CISA KEV per the provided findings, so exploit status is not confirmed there—still, upgrade based on the vendor remediation and the high severity.

Technical context

Severity and weakness: High severity (CVSS 7.8) with CWE-119 (memory corruption). The likely impact is denial of service and, in the worst case, arbitrary code execution in a privileged context.

Mechanism: The IOHIDFamily component in Apple OS X/macOS versions before 10.11.5 has a memory-handling flaw that can be triggered by a crafted app, leading to memory corruption.

Attack vector / prerequisites: Local/user interaction is indicated by the attack characteristics in the provided CVSS (attack is not purely remote). Exploitation requires opening/using a crafted app rather than just reaching a network service.

Exploit maturity: No public exploit code was found on record in the provided findings; KEV is not listed. Press attention has been rising, but that alone is not evidence of widespread exploitation.

EPSS: A predicted likelihood was provided (trend flat), but since KEV/news do not confirm exploitation in the findings, it should not be used as the deciding factor compared to patch availability.

Fix: Vendor remediation calls for upgrading to OS X/macOS 10.11.5 or newer.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS93rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

5.6% chance of exploitation activity in the next 30 days, which ranks it in the 93rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 3778 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderateepss band change
2026-09-06EPSS band changemoderate → lowepss band change
2026-09-05EPSS band change0 → moderateepss band change
2026-08-31EPSS band changemoderate → 0epss band change
2026-08-29EPSS band changelow → moderate

Affected products

Apple Inc.commercial · USaka apple, apple computer
- mac os xOSOn-premOperating Systems / unix-bsd
- OS XOperating Systems

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable