What is the CVSS score of CVE-2025-43530?

CVE-2025-43530 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

iOS CVE-2025-43530

MEDIUM

Information Exposure (CWE-200)

2025-12-12 product-security@apple.com

Apple iOS Information Disclosure

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Dec 12, 2025 - 21:15 nvd

MEDIUM 5.5

DescriptionCVE.org

This issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.

AnalysisAI

Local apps on Apple macOS and iPadOS can access sensitive user data through inadequate information disclosure controls, requiring local execution and low-level user privileges. Affected versions include iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Sequoia 15.7.2 and earlier, macOS Sonoma 14.8.2 and earlier, and macOS Tahoe 26.1 and earlier. Apple has released patched versions (iOS 18.7.3, iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2) with improved access controls to restrict unauthorized data exposure. With an EPSS score of 0.02% (4th percentile) and no public exploit code identified at time of analysis, this represents a low real-world exploitation probability despite the moderate CVSS score.

Technical ContextAI

This vulnerability stems from inadequate information disclosure controls (CWE-200) in Apple's operating system kernel or system libraries responsible for enforcing data access boundaries between applications. The issue affects the macOS and iOS/iPadOS families across multiple major versions (Sonoma, Sequoia, Tahoe on macOS; iOS/iPadOS 18.x). The vulnerability requires local code execution with low-level privileges (PR:L per CVSS vector), suggesting the attack occurs at the application or user-space level rather than requiring kernel-level access. The local attack vector (AV:L) and absence of complex preconditions (AC:L) indicate that once an attacker gains code execution in the context of a user-privileged process, they can directly read sensitive data without additional complexity or user interaction.

RemediationAI

Vendor-released patches address this vulnerability in iOS 18.7.3, iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2. Users should update their affected Apple devices immediately through Settings > General > Software Update on iOS/iPadOS or System Settings > General > Software Update on macOS. Organizations managing multiple macOS or iOS devices should prioritize deployment across their fleet using Mobile Device Management (MDM) tools or standard software update procedures. No workarounds are available; patching is the only remediation. Refer to Apple's official security advisories at https://support.apple.com/en-us/125885, https://support.apple.com/en-us/125886, https://support.apple.com/en-us/125887, and https://support.apple.com/en-us/125888 for deployment details and to verify your device's affected status.