CVE-2025-43518
LOWCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2Description
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, watchOS 26.2. An app may be able to inappropriately access files through the spellcheck API.
Analysis
Local privilege escalation in Apple's spellcheck API allows authenticated users to inappropriately access files on macOS, iOS, and related platforms through a logic flaw in access controls. Affected versions include macOS Sonoma 14.x and earlier, macOS Sequoia 15.7.2 and earlier, iOS 18.x and earlier, iPadOS 18.x and earlier, and watchOS 11.x and earlier. This vulnerability requires local access and user-level privileges but carries a low EPSS score (0.01%, percentile 3%) indicating minimal real-world exploitation likelihood at present. No public exploit code or active exploitation has been identified.
Technical Context
This vulnerability stems from improper access control logic (CWE-284) in Apple's spellcheck API implementation across multiple operating systems. The spellcheck service, which runs as a privileged system component, did not properly validate access permissions when processing file requests from applications. An authenticated local user could craft requests through the spellcheck API to bypass the intended file access restrictions, potentially reading files they should not have access to. The flaw affects the core permission-checking mechanism rather than the spellcheck functionality itself, making it a systemic access control issue across iOS, iPadOS, macOS (multiple versions), and watchOS platforms.
Affected Products
iOS through version 18.0, iPadOS through version 18.0, macOS Sonoma through version 14.8.2, macOS Sequoia through version 15.7.2, macOS Tahoe through version 26.1, and watchOS through version 11.0 are affected. All macOS versions are referenced in the CPE data (cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*), indicating the vulnerability spans multiple macOS major versions released over several years. The logic flaw in the spellcheck API implementation is consistent across all these platforms and OS versions until the respective patched releases are installed.
Remediation
Apple has released patched versions addressing this vulnerability: iOS 18.1 and later, iPadOS 18.1 and later, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, and watchOS 11.1 and later. Users should immediately update to these versions through System Preferences > General > Software Update (macOS) or Settings > General > Software Update (iOS/iPadOS/watchOS). For organizations managing multiple devices, deploying these updates through mobile device management (MDM) is recommended. Apple's official security updates are available at https://support.apple.com/en-us/125884 (iOS), https://support.apple.com/en-us/125886 (iPadOS), https://support.apple.com/en-us/125887 (macOS), https://support.apple.com/en-us/125888 (watchOS), and https://support.apple.com/en-us/125890 (additional guidance). No workarounds are available; patching is the only remediation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today