iOS CVE-2025-43534

Despite the absence of a CVSS score and EPSS probability metric, this vulnerability carries elevated real-world risk due to several factors: the attack vector requires physical access (moderate complexity), but the impact—complete bypass of Activation Lock—represents a critical authentication control designed to prevent stolen device abuse. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog based on available data, suggesting no active in-the-wild exploitation at disclosure time. However, the simplicity of physical-access attacks and the high value of device theft mean this will likely be exploited once techniques are published. The lack of public POC and SSVC assessment data limits definitive risk quantification, but the combination of a critical control bypass affecting all users with physical access to a device, coupled with rapid patch deployment across iOS 18.7.7 and 26.2, indicates Apple's high internal risk assessment. This should be treated as a priority patch despite missing numerical risk scores.

An attacker with physical access to a stolen or obtained iOS device could exploit this path handling vulnerability to bypass Activation Lock without entering the device owner's Apple ID credentials. By manipulating file paths during the device boot or unlock sequence, the attacker circumvents the authentication prompt and gains full device access, potentially exfiltrating sensitive data, financial accounts, and personal information stored on the device. This scenario is particularly dangerous given that Activation Lock is explicitly designed to render stolen devices unusable—this vulnerability nullifies that protection in seconds with minimal technical complexity.