CVE-2025-43200
Apple Multiple Products Unspecified Vulnerability
Description
CVE-2025-43200 is a medium-severity logic vulnerability affecting a wide range of Apple products, including iOS, iPadOS, macOS, watchOS, and visionOS. The issue involves improper checks when processing maliciously crafted photos or videos shared via iCloud Links, potentially allowing an attacker to impact both confidentiality and integrity of the target device. With a CVSS v3.1 base score of 4.2 (MEDIUM severity), the attack requires high complexity and user interaction, but Apple has acknowledged that this vulnerability may have been exploited in an extremely sophisticated attack targeting specific individuals. CISA has added CVE-2025-43200 to the Known Exploited Vulnerabilities catalog, underscoring the seriousness of the threat despite the lower CVSS score. The vulnerability has been patched across multiple Apple operating system versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 15.8.4; >= 16.0, < 16.7.11; >= 17.0, < 17.7.5; >= 18.0, < 18.3.1 |
| apple | iphone os | < 15.8.4; >= 16.0, <= 16.7.11; >= 17.0, <= 18.3.1 |
| apple | macos | >= 13.0, < 13.7.4; >= 14.0, < 14.7.4; >= 15.0, < 15.3.1 |
| apple | visionos | < 2.3.1 |
| apple | watchos | < 11.3.1 |
References
- https://support.apple.com/en-us/122173(Vendor Advisory)
- https://support.apple.com/en-us/122174(Vendor Advisory)
- https://support.apple.com/en-us/122345(Vendor Advisory)
- https://support.apple.com/en-us/122346(Vendor Advisory)
- https://support.apple.com/en-us/122900(Vendor Advisory)
- https://support.apple.com/en-us/122901(Vendor Advisory)
- https://support.apple.com/en-us/122902(Vendor Advisory)
- https://support.apple.com/en-us/122903(Vendor Advisory)
- https://support.apple.com/en-us/122904(Vendor Advisory)
- https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/(Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43200(US Government Resource)
Weakness Type
No CWE classification has been assigned to this vulnerability.
Impact Analysis
The impact of CVE-2025-43200 is nuanced despite its MEDIUM CVSS score of 4.2. Confidentiality (Low) and Integrity (Low) are affected, while availability is not impacted. The attack requires network access (AV:N) but has high complexity (AC:H) and requires user interaction (UI:R), meaning the attacker must craft a specific malicious photo or video and trick the victim into processing it through an iCloud Link. While the CVSS score is relatively low, Apple's own assessment that this vulnerability was used in an "extremely sophisticated attack against specific targeted individuals" indicates it was leveraged as part of a targeted surveillance operation. The low EPSS score of 0.32% reflects the highly targeted nature of exploitation rather than mass exploitation campaigns. The breadth of affected products, spanning iOS, iPadOS, macOS, watchOS, and visionOS, means virtually the entire Apple ecosystem was vulnerable to this specific attack vector.
Exploit Maturity
CVE-2025-43200 has a unique exploit maturity profile. While the EPSS score of 0.32% at the 54th percentile suggests limited mass exploitation, Apple's own disclosure states the vulnerability was exploited in an "extremely sophisticated attack against specific targeted individuals." CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. No public exploit code is available in the references, which is consistent with the targeted nature of the attacks. Research from Citizen Lab has linked this vulnerability to commercial mercenary spyware operations targeting journalists, indicating that state-level threat actors possess working exploits. The absence of mass exploitation does not diminish the severity for high-risk individuals such as journalists, activists, and government officials who may be targeted by commercial surveillance vendors.
Remediation
-
Update all Apple devices immediately to the patched versions: iOS 18.3.1 / iPadOS 18.3.1, iOS 16.7.11 / iPadOS 16.7.11, iOS 15.8.4 / iPadOS 15.8.4, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, watchOS 11.3.1, and visionOS 2.3.1.
-
Enable automatic updates on all Apple devices to ensure future security patches are applied promptly. For managed enterprise environments, use MDM solutions to push updates to all enrolled devices and verify compliance.
-
Exercise caution with shared iCloud Links from untrusted or unexpected sources. Organizations managing high-risk individuals should implement policies around reviewing shared media links before opening them, particularly links received from unknown contacts.
-
Enable Lockdown Mode on devices used by individuals who may be at risk of targeted surveillance attacks, such as journalists, activists, and government officials. Apple's Lockdown Mode significantly reduces the attack surface by limiting features that are commonly exploited in sophisticated attacks.
-
Review device logs and indicators for any signs of compromise, particularly if devices were running vulnerable versions during the exploitation window. Apple provides threat notifications to users targeted by state-sponsored attacks.
Technical Details
CVE-2025-43200 is a logic vulnerability in Apple's media processing framework that handles photos and videos shared via iCloud Links. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N reflects a network-accessible (AV:N) attack with high complexity (AC:H), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and low impact on confidentiality (C:L) and integrity (I:L). The vulnerability exists in the validation checks performed when a device processes shared media content received through iCloud Link sharing. A maliciously crafted photo or video can exploit insufficient validation in the media processing pipeline to achieve unauthorized effects on the target device. Apple has described the fix as "improved checks," indicating that the original validation logic failed to account for certain edge cases in the media format parsing. The fact that this vulnerability was used in what Apple describes as an "extremely sophisticated attack against specific targeted individuals" suggests the exploit was developed by a commercial surveillance vendor, potentially Paragon Solutions based on Citizen Lab's research. The broad scope of affected platforms (iOS, iPadOS, macOS, watchOS, visionOS) indicates the vulnerable code exists in a shared media processing framework used across all Apple operating systems.
Frequently Asked Questions
Is CVE-2025-43200 being actively exploited?
Yes, Apple has confirmed that this vulnerability "may have been exploited in an extremely sophisticated attack against specific targeted individuals," and CISA has added it to the Known Exploited Vulnerabilities catalog. The low EPSS score of 0.32% reflects the highly targeted nature of the attacks rather than mass exploitation.
What products are affected by CVE-2025-43200?
A wide range of Apple products are affected: iOS (all versions prior to 15.8.4, 16.7.11, and 18.3.1), iPadOS (prior to 15.8.4, 16.7.11, 17.7.5, and 18.3.1), macOS Ventura (prior to 13.7.4), macOS Sonoma (prior to 14.7.4), macOS Sequoia (prior to 15.3.1), watchOS (prior to 11.3.1), and visionOS (prior to 2.3.1).
How do I fix CVE-2025-43200?
Update all Apple devices to the latest available operating system versions. Enable automatic updates and consider enabling Lockdown Mode on devices used by individuals at risk of targeted surveillance attacks.
How severe is CVE-2025-43200?
CVE-2025-43200 has a CVSS v3.1 score of 4.2 (MEDIUM severity), reflecting the high attack complexity and user interaction requirements. However, the confirmed use in sophisticated targeted surveillance operations, potentially linked to commercial mercenary spyware, makes this vulnerability exceptionally dangerous for high-risk individuals despite the moderate technical severity rating.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.