CVE-2025-43542
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2Description
This issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Tahoe 26.2, visionOS 26.2. Password fields may be unintentionally revealed when remotely controlling a device over FaceTime.
Analysis
Password field disclosure in Apple operating systems allows remote observation of credentials during FaceTime screen sharing sessions. Affects iOS/iPadOS 18.x through 18.7.2, iOS/iPadOS 26.0-26.1, macOS Sequoia through 15.7.2, macOS Tahoe through 26.1, and visionOS through 26.1. Attackers with network access to FaceTime sessions can view password fields that should be masked, creating credential exposure risk during remote support or collaboration scenarios. EPSS score of 0.03% (10th percentile) indicates low automated exploitation probability, and no public exploit identified at time of analysis.
Technical Context
This vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) in Apple's state management implementation for password field rendering during FaceTime-based remote control sessions. When a user shares their screen or allows remote control via FaceTime, the system should mask password input fields to prevent visual disclosure. The flaw in state management causes password fields to render in cleartext instead of being properly obfuscated during these remote sessions. This affects multiple Apple platforms sharing common UI rendering frameworks: iOS/iPadOS, macOS (both Sequoia and Tahoe releases), and visionOS. The vulnerability resides in the interaction layer between FaceTime's screen sharing protocol and the operating system's secure input handling mechanisms, suggesting a race condition or improper state transition when switching between local and remote display contexts.
Affected Products
Apple iOS versions prior to 18.7.3, Apple iPadOS versions prior to 18.7.3, Apple iOS versions 26.0 through 26.1, Apple iPadOS versions 26.0 through 26.1, Apple macOS Sequoia versions prior to 15.7.3, Apple macOS Tahoe versions prior to 26.2, and Apple visionOS versions prior to 26.2 are confirmed affected per CPE designation cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* and vendor advisories. Apple has released security updates addressing this issue across all affected platforms, documented in support articles HT241184, HT241185, HT241186, HT241187, and HT241191 available at support.apple.com.
Remediation
Apply vendor-released patches immediately for devices using FaceTime screen sharing features. Upgrade iOS and iPadOS devices to version 18.7.3 or 26.2 (depending on major version branch), macOS Sequoia systems to version 15.7.3, macOS Tahoe systems to version 26.2, and visionOS devices to version 26.2. Apple addressed the vulnerability through improved state management in password field rendering during remote sessions. Deployment instructions and security content details are available in Apple support articles at https://support.apple.com/en-us/125884, https://support.apple.com/en-us/125885, https://support.apple.com/en-us/125886, https://support.apple.com/en-us/125887, and https://support.apple.com/en-us/125891. Organizations unable to patch immediately should implement compensatory controls: prohibit password entry during FaceTime screen sharing sessions, require users to pause screen sharing before accessing password-protected resources, use password managers with clipboard-based autofill instead of visible typing, and educate users about the risk of credential exposure during remote support sessions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today