CVE-2025-43200

Apple Multiple Products Unspecified

4.2 MEDIUMActively exploited (CISA KEV)EPSS 1.19%

Published16 Jun 2025
Added to CISA KEV16 Jun 2025
Remediation due7 Jul 2025

Description

This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

Apple iPadOS≥ 16.0 < 16.7.11 · ≥ 17.0 < 17.7.5 · ≥ 18.0 < 18.3.1 · < 15.8.4

Apple iPhone OS≥ 16.0 ≤ 16.7.11 · ≥ 17.0 ≤ 18.3.1 · < 15.8.4

Apple macOS≥ 13.0 < 13.7.4 · ≥ 14.0 < 14.7.4 · ≥ 15.0 < 15.3.1

Apple Visionos< 2.3.1

Apple Watchos< 11.3.1

Remediation

Fixed in

Apple iPadOS≥ 16.7.11

Apple iPhone OS≥ 15.8.4

Apple macOS≥ 13.7.4

Apple Visionos≥ 2.3.1

Apple Watchos≥ 11.3.1

Patch & vendor advisories

References

https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/Press/Media Coverage
https://support.apple.com/en-us/122173Vendor Advisory
https://support.apple.com/en-us/122174Vendor Advisory
https://support.apple.com/en-us/122345Vendor Advisory
https://support.apple.com/en-us/122346Vendor Advisory
https://support.apple.com/en-us/122900Vendor Advisory
https://support.apple.com/en-us/122901Vendor Advisory
https://support.apple.com/en-us/122902Vendor Advisory
https://support.apple.com/en-us/122903Vendor Advisory
https://support.apple.com/en-us/122904Vendor Advisory

and 1 more references

Frequently asked

Is CVE-2025-43200 being actively exploited?

Yes. CVE-2025-43200 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 16 Jun 2025.

How severe is CVE-2025-43200?

CVE-2025-43200 has a CVSS 3.1 base score of 4.2, rated medium. EPSS estimates a 1.19% probability of exploitation.

Which products are affected by CVE-2025-43200?

Affected products include Apple iPadOS, Apple iPhone OS, Apple macOS, Apple Visionos, Apple Watchos.

How do I fix CVE-2025-43200?

Upgrade affected software to a fixed version, for example Apple iPadOS 16.7.11, Apple iPhone OS 15.8.4, Apple macOS 13.7.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-43200 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.