Skip to main content

iOS CVE-2025-43217

MEDIUM
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)
2025-07-30 product-security@apple.com
4.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.0 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Apr 02, 2026 - 19:37 vuln.today
CVE Published
Jul 30, 2025 - 00:15 nvd
MEDIUM 4.0

DescriptionCVE.org

The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera access may not be correctly displayed.

AnalysisAI

Privacy indicator bypass in Apple iOS and iPadOS allows local attackers to determine microphone or camera access without user notification. The vulnerability affects iOS 18.6 and earlier, and iPadOS 17.7.9 and earlier, enabling unauthorized monitoring of privacy-sensitive device activity. Apple has released patched versions (iOS 18.6, iPadOS 18.6, and iPadOS 17.7.9) that add logic to correctly display privacy indicators when microphone or camera access occurs. EPSS exploitation probability is very low at 0.02%, and no public exploit code has been identified.

Technical ContextAI

This vulnerability exploits a flaw in the privacy indicator subsystem of Apple's operating systems, specifically in the mechanism responsible for notifying users when applications access the microphone or camera hardware. The root cause is classified under CWE-359 (Exposure of Private Information to an Unauthorized Actor), indicating that sensitive information about hardware access state is not properly communicated to the user through the standard visual privacy indicators. The affected products span multiple iOS and iPadOS versions across iPhone and iPad devices (cpe:2.3:o:apple:iphone_os and cpe:2.3:o:apple:ipados), suggesting the vulnerability exists in a core operating system component that manages privacy notifications across all affected device types.

RemediationAI

Users should immediately update to patched versions: iOS 18.6 or later for iPhone, iPadOS 18.6 or later for iPad, or iPadOS 17.7.9 or later for devices unable to upgrade to the current major version. The patch adds additional logic to the privacy indicator system to ensure microphone and camera access is correctly displayed to users. Updates are available through Settings > General > Software Update on affected devices. Users unable to update immediately should monitor their device for unexpected microphone or camera indicator activity and consider restricting app permissions through Settings > Privacy until updates can be applied. Consult Apple's security advisories at https://support.apple.com/en-us/124147 and https://support.apple.com/en-us/124148 for additional guidance.

More in iOS

View all
CVE-2023-43000 HIGH POC
8.8 Nov 05

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability

CVE-2026-20700 HIGH POC
7.8 Feb 11

Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV

CVE-2023-41974 HIGH POC
7.8 Jan 10

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability

CVE-2014-7992 MEDIUM POC
5.0 Nov 18

The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti

CVE-2022-48618 HIGH
7.0 Jan 09

The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)

CVE-2025-66555 HIGH POC
8.8 Dec 04

AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type

CVE-2025-46335 HIGH POC
8.6 May 05

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo

CVE-2021-1385 MEDIUM POC
6.5 Mar 24

A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate

CVE-2026-31852 CRITICAL
10.0 Mar 11

Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.

CVE-2025-43234 CRITICAL
9.8 Jul 30

Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO

CVE-2025-43186 CRITICAL
9.8 Jul 30

Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS

CVE-2023-40414 CRITICAL
9.8 Jan 10

A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi

Share

CVE-2025-43217 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy