What is the CVSS score of CVE-2025-43230?

CVE-2025-43230 has a CVSS 3.1 base score of 4.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

iOS CVE-2025-43230

MEDIUM

Incorrect Authorization (CWE-863)

2025-07-30 product-security@apple.com

Apple iOS Information Disclosure Privilege Escalation Ipados Iphone Os Tvos Visionos Watchos

4.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.0 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

MEDIUM 4.0

DescriptionCVE.org

The issue was addressed with additional permissions checks. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. An app may be able to access user-sensitive data.

AnalysisAI

Insufficient permission checks in Apple operating systems allow local apps to access user-sensitive data without proper authorization. The vulnerability affects iOS 18.5 and earlier, iPadOS 18.5 and earlier (and iPadOS 17.7.8 and earlier), macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unprivileged local application can exploit this to read sensitive user information by circumventing the permission model. No public exploit code has been identified at time of analysis, and EPSS scoring (0.02%, 4th percentile) indicates very low real-world exploitation probability despite the information disclosure impact.

Technical ContextAI

This vulnerability stems from an authentication/authorization bypass (CWE-863: Improper Authorization) in Apple's multi-platform permission enforcement framework. The issue affects the core security boundary that protects user-sensitive data on iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The CVSS vector (AV:L/AC:L/PR:N) indicates a local attack vector with low complexity and no privilege requirement, meaning any app installed on a device can attempt exploitation. The underlying problem is that permission checks were not sufficiently comprehensive in certain data access paths, allowing applications to read information they should not have access to. This is a classic privilege escalation or permission bypass at the application sandbox level rather than a memory safety or cryptographic flaw.

RemediationAI

Update affected devices to the patched versions immediately: iOS 18.6 or later, iPadOS 18.6 or later (or iPadOS 17.7.9 if running iPadOS 17), macOS Sequoia 15.6 or later, tvOS 18.6 or later, visionOS 2.6 or later, and watchOS 11.6 or later. Users can enable automatic updates in device settings to receive patches as soon as available. Organizations managing Apple device fleets should prioritize deployment of these OS updates, though the low EPSS score and lack of active exploitation allow for standard deployment windows rather than emergency rollout. Consult the official Apple security advisories at https://support.apple.com/en-us/124147 through https://support.apple.com/en-us/124155 for complete patch notes and deployment guidance.