What is the CVSS score of CVE-2025-43518?

CVE-2025-43518 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

iOS CVE-2025-43518

LOW

Improper Access Control (CWE-284)

2025-12-12 product-security@apple.com

Apple iOS macOS Information Disclosure Path Traversal

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Dec 12, 2025 - 21:15 nvd

LOW 3.3

DescriptionCVE.org

A logic issue was addressed with improved checks. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, watchOS 26.2. An app may be able to inappropriately access files through the spellcheck API.

AnalysisAI

Local privilege escalation in Apple's spellcheck API allows authenticated users to inappropriately access files on macOS, iOS, and related platforms through a logic flaw in access controls. Affected versions include macOS Sonoma 14.x and earlier, macOS Sequoia 15.7.2 and earlier, iOS 18.x and earlier, iPadOS 18.x and earlier, and watchOS 11.x and earlier. This vulnerability requires local access and user-level privileges but carries a low EPSS score (0.01%, percentile 3%) indicating minimal real-world exploitation likelihood at present. No public exploit code or active exploitation has been identified.

Technical ContextAI

This vulnerability stems from improper access control logic (CWE-284) in Apple's spellcheck API implementation across multiple operating systems. The spellcheck service, which runs as a privileged system component, did not properly validate access permissions when processing file requests from applications. An authenticated local user could craft requests through the spellcheck API to bypass the intended file access restrictions, potentially reading files they should not have access to. The flaw affects the core permission-checking mechanism rather than the spellcheck functionality itself, making it a systemic access control issue across iOS, iPadOS, macOS (multiple versions), and watchOS platforms.

RemediationAI

Apple has released patched versions addressing this vulnerability: iOS 18.1 and later, iPadOS 18.1 and later, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, and watchOS 11.1 and later. Users should immediately update to these versions through System Preferences > General > Software Update (macOS) or Settings > General > Software Update (iOS/iPadOS/watchOS). For organizations managing multiple devices, deploying these updates through mobile device management (MDM) is recommended. Apple's official security updates are available at https://support.apple.com/en-us/125884 (iOS), https://support.apple.com/en-us/125886 (iPadOS), https://support.apple.com/en-us/125887 (macOS), https://support.apple.com/en-us/125888 (watchOS), and https://support.apple.com/en-us/125890 (additional guidance). No workarounds are available; patching is the only remediation.