iOS CVE-2025-43428
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Photos in the Hidden Photos Album may be viewed without authentication.
AnalysisAI
Unauthenticated access to Hidden Photos Album in Apple iOS, iPadOS, macOS, and visionOS allows remote attackers to view protected photos without authentication due to a configuration flaw. Fixed in iOS/iPadOS 26.2, macOS Tahoe 26.2, and visionOS 26.2. CVSS 9.8 (Critical) reflects network-based unauthenticated access, though EPSS of 0.13% (32nd percentile) suggests low observed exploitation probability. No public exploit identified at time of analysis, and not listed in CISA KEV. This represents a privacy-critical authentication bypass affecting Apple's Photos app across all major platforms.
Technical ContextAI
This vulnerability stems from CWE-306 (Missing Authentication for Critical Function), specifically a misconfiguration in Apple's Photos application framework that failed to enforce authentication checks when accessing the Hidden Photos Album. The Hidden Photos Album is a privacy feature designed to protect sensitive images from casual viewing, requiring Face ID, Touch ID, or device passcode authentication. The configuration flaw allowed the authentication gate to be bypassed entirely, enabling network-accessible exposure of what users assumed were protected assets. Affected products span Apple's entire ecosystem: iOS (iPhone OS) versions prior to 26.2, iPadOS prior to 26.2, macOS prior to Tahoe 26.2, and visionOS prior to 26.2, as identified by CPE strings for apple:iphone_os, apple:ipados, apple:macos, and apple:visionos. The fix involved implementing additional configuration restrictions to properly enforce authentication requirements before album access.
RemediationAI
Vendor-released patches are available: immediately update to iOS 26.2 and iPadOS 26.2 for mobile devices, macOS Tahoe 26.2 for Mac computers, and visionOS 26.2 for Apple Vision Pro devices. These updates address the configuration issue by implementing additional authentication restrictions on Hidden Photos Album access. Updates can be installed through System Settings > General > Software Update on iOS/iPadOS, System Settings > General > Software Update on macOS, or Settings > General > Software Update on visionOS. No workarounds are available; patching is the only remediation path. Organizations managing Apple devices through MDM solutions should deploy these updates as high-priority to protect user privacy. Detailed installation instructions and security content information are available in Apple's support bulletins at https://support.apple.com/en-us/125884, https://support.apple.com/en-us/125886, and https://support.apple.com/en-us/125891.
More from same product – last 7 days
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Dock
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape
Local privilege escalation in Apple macOS allows a malicious app already running with low privileges to elevate to root
Local privilege escalation in Canonical Multipass for macOS before 1.16.3 allows a low-privileged local user to obtain r
Share
External POC / Exploit Code
Leaving vuln.today