What is the CVSS score of CVE-2025-43428?

CVE-2025-43428 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of iOS are affected by CVE-2025-43428?

CVE-2025-43428 is a critical authentication bypass in Apple's Photos application (iOS, iPadOS, macOS, visionOS) that allows unauthenticated remote attackers to access users' protected photo libraries…

How to fix or mitigate CVE-2025-43428?

Within 24 hours: Inventory all iOS, iPadOS, macOS, and visionOS devices in your environment and identify current OS versions. Within 7 days: Advise users to avoid storing sensitive photos on affected devices until patching completes. Within 30 days: Deploy iOS/iPadOS 26.2, macOS Tahoe 26.2, and visionOS 26.2 across all organizational devices; prioritize devices storing business-sensitive or regulated data first.

iOS CVE-2025-43428

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2025-12-17 product-security@apple.com

Apple iOS Authentication Bypass Information Disclosure Ipados Iphone Os Visionos

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Dec 17, 2025 - 21:16 nvd

CRITICAL 9.8

DescriptionCVE.org

A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Photos in the Hidden Photos Album may be viewed without authentication.

AnalysisAI

Unauthenticated access to Hidden Photos Album in Apple iOS, iPadOS, macOS, and visionOS allows remote attackers to view protected photos without authentication due to a configuration flaw. Fixed in iOS/iPadOS 26.2, macOS Tahoe 26.2, and visionOS 26.2. CVSS 9.8 (Critical) reflects network-based unauthenticated access, though EPSS of 0.13% (32nd percentile) suggests low observed exploitation probability. No public exploit identified at time of analysis, and not listed in CISA KEV. This represents a privacy-critical authentication bypass affecting Apple's Photos app across all major platforms.

Technical ContextAI

This vulnerability stems from CWE-306 (Missing Authentication for Critical Function), specifically a misconfiguration in Apple's Photos application framework that failed to enforce authentication checks when accessing the Hidden Photos Album. The Hidden Photos Album is a privacy feature designed to protect sensitive images from casual viewing, requiring Face ID, Touch ID, or device passcode authentication. The configuration flaw allowed the authentication gate to be bypassed entirely, enabling network-accessible exposure of what users assumed were protected assets. Affected products span Apple's entire ecosystem: iOS (iPhone OS) versions prior to 26.2, iPadOS prior to 26.2, macOS prior to Tahoe 26.2, and visionOS prior to 26.2, as identified by CPE strings for apple:iphone_os, apple:ipados, apple:macos, and apple:visionos. The fix involved implementing additional configuration restrictions to properly enforce authentication requirements before album access.

RemediationAI

Vendor-released patches are available: immediately update to iOS 26.2 and iPadOS 26.2 for mobile devices, macOS Tahoe 26.2 for Mac computers, and visionOS 26.2 for Apple Vision Pro devices. These updates address the configuration issue by implementing additional authentication restrictions on Hidden Photos Album access. Updates can be installed through System Settings > General > Software Update on iOS/iPadOS, System Settings > General > Software Update on macOS, or Settings > General > Software Update on visionOS. No workarounds are available; patching is the only remediation path. Organizations managing Apple devices through MDM solutions should deploy these updates as high-priority to protect user privacy. Detailed installation instructions and security content information are available in Apple's support bulletins at https://support.apple.com/en-us/125884, https://support.apple.com/en-us/125886, and https://support.apple.com/en-us/125891.