CVE-2025-43200

This issue was addressed with improved checks. This issue is fixed in watchOS 11.3.1, macOS...

4.2 MediumIn KEV

This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.19%Up 0.2 points since Jun 17, 2025

What each source reports

CVE List Score used 4.2

Record: CVE-2025-43200
CVSS 3.1: 4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

EUVDEUVD-2025-18428 4.2

Record: EUVD-2025-18428
CVSS 3.1: 4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-whff-4x34-r5vx 4.8

This issue was addressed with improved checks. This issue is fixed in watchOS 11.3.1, macOS...

This issue was addressed with improved checks. This issue is fixed in watchOS 11.3.1, macOS Ventura 13.7.4, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iPadOS 17.7.5, visionOS 2.3.1, macOS Sequoia 15.3.1, iOS 18.3.1 and iPadOS 18.3.1, macOS Sonoma 14.7.4. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Record: GHSA-whff-4x34-r5vx
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

CISA KEV No score

Apple Multiple Products Unspecified Vulnerability

Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.

Record: CVE-2025-43200
Updated: 2026-11-02

NVD 4.2

Record: CVE-2025-43200
CVSS 3.1: 4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-43200 is a medium vulnerability (CVSS 4.2) in Apple Ipados, published June 16, 2025. CISA lists it as known to be exploited, since June 16, 2025. EUVD reports exploitation since June 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. No source names a fixed version.

References

Show 7 moreShow less