CVE-2025-43200
Summary
| CVE | CVE-2025-43200 |
|---|---|
| State | PUBLISHED |
| Assigner | apple |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-06-16 22:16:41 UTC |
| Updated | 2026-04-02 19:20:03 UTC |
| Description | This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. |
Risk And Classification
Primary CVSS: v3.1 4.2 MEDIUM from ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS: 0.005190000 probability, percentile 0.667550000 (date 2026-04-02)
CISA KEV: Listed on 2025-06-16; due 2025-07-07; ransomware use Unknown
Problem Types: NVD-CWE-noinfo | A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. | CWE-noinfo Not enough information
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 4.2 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 4.2 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA Known Exploited Vulnerability
| Vendor | Apple |
|---|---|
| Product | Multiple Products |
| Name | Apple Multiple Products Unspecified Vulnerability |
| Required Action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
| Notes | https://support.apple.com/en-us/122174 ; https://support.apple.com/en-us/122173 ; https://support.apple.com/en-us/122900 ; https://support.apple.com/en-us/122901 ; https://support.apple.com/en-us/122902 ; https://support.apple.com/en-us/122903 ; https://support.apple.com/en-us/122904 ; https://nvd.nist.gov/vuln/detail/CVE-2025-43200 |
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apple | IOS And IPadOS | affected 15.8.4 custom | Not specified |
| CNA | Apple | IOS And IPadOS | affected 16.7.11 custom | Not specified |
| CNA | Apple | IOS And IPadOS | affected 18.3.1 custom | Not specified |
| CNA | Apple | IPadOS | affected 17.7.5 custom | Not specified |
| CNA | Apple | MacOS | affected 13.7.4 custom | Not specified |
| CNA | Apple | MacOS | affected 14.7.4 custom | Not specified |
| CNA | Apple | MacOS | affected 15.3.1 custom | Not specified |
| CNA | Apple | VisionOS | affected 2.3.1 custom | Not specified |
| CNA | Apple | WatchOS | affected 11.3.1 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| support.apple.com/en-us/122904 | [email protected] | support.apple.com | Vendor Advisory |
| support.apple.com/en-us/122173 | [email protected] | support.apple.com | Vendor Advisory |
| support.apple.com/en-us/122900 | [email protected] | support.apple.com | Vendor Advisory |
| support.apple.com/en-us/122902 | [email protected] | support.apple.com | Vendor Advisory |
| support.apple.com/en-us/122346 | [email protected] | support.apple.com | Vendor Advisory |
| support.apple.com/en-us/122903 | [email protected] | support.apple.com | Vendor Advisory |
| support.apple.com/en-us/122345 | [email protected] | support.apple.com | Vendor Advisory |
| support.apple.com/en-us/122174 | [email protected] | support.apple.com | Vendor Advisory |
| support.apple.com/en-us/122901 | [email protected] | support.apple.com | Vendor Advisory |
| citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary... | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | citizenlab.ca | Press/Media Coverage |
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.