iOS
CVE-2025-43217
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera access may not be correctly displayed.
AnalysisAI
Privacy indicator bypass in Apple iOS and iPadOS allows local attackers to determine microphone or camera access without user notification. The vulnerability affects iOS 18.6 and earlier, and iPadOS 17.7.9 and earlier, enabling unauthorized monitoring of privacy-sensitive device activity. Apple has released patched versions (iOS 18.6, iPadOS 18.6, and iPadOS 17.7.9) that add logic to correctly display privacy indicators when microphone or camera access occurs. EPSS exploitation probability is very low at 0.02%, and no public exploit code has been identified.
Technical ContextAI
This vulnerability exploits a flaw in the privacy indicator subsystem of Apple's operating systems, specifically in the mechanism responsible for notifying users when applications access the microphone or camera hardware. The root cause is classified under CWE-359 (Exposure of Private Information to an Unauthorized Actor), indicating that sensitive information about hardware access state is not properly communicated to the user through the standard visual privacy indicators. The affected products span multiple iOS and iPadOS versions across iPhone and iPad devices (cpe:2.3:o:apple:iphone_os and cpe:2.3:o:apple:ipados), suggesting the vulnerability exists in a core operating system component that manages privacy notifications across all affected device types.
RemediationAI
Users should immediately update to patched versions: iOS 18.6 or later for iPhone, iPadOS 18.6 or later for iPad, or iPadOS 17.7.9 or later for devices unable to upgrade to the current major version. The patch adds additional logic to the privacy indicator system to ensure microphone and camera access is correctly displayed to users. Updates are available through Settings > General > Software Update on affected devices. Users unable to update immediately should monitor their device for unexpected microphone or camera indicator activity and consider restricting app permissions through Settings > Privacy until updates can be applied. Consult Apple's security advisories at https://support.apple.com/en-us/124147 and https://support.apple.com/en-us/124148 for additional guidance.
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today