What is the CVSS score of CVE-2025-43542?

CVE-2025-43542 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2025-43542?

CVE-2025-43542 exposes passwords in Apple FaceTime screen sharing sessions, allowing network-positioned attackers to view unmasked credentials during remote support and collaboration activities.

How to fix or mitigate CVE-2025-43542?

24 hours: Inventory FaceTime usage in remote support and IT helpdesk workflows; communicate to staff that password fields may be visible during screen sharing. 7 days: Implement interim policy prohibiting screen sharing of authentication prompts or credential entry screens; evaluate alternative secure remote support tools. 30 days: Monitor Apple security advisories for patch availability to iOS/iPadOS 18.x, 26.x, macOS Sequoia 15.x, macOS Tahoe 26.x, and visionOS 26.x; apply immediately upon release.

iOS CVE-2025-43542

HIGH

Information Exposure (CWE-200)

2025-12-12 product-security@apple.com

Apple iOS Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Dec 12, 2025 - 21:15 nvd

HIGH 7.5

DescriptionCVE.org

This issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Tahoe 26.2, visionOS 26.2. Password fields may be unintentionally revealed when remotely controlling a device over FaceTime.

AnalysisAI

Password field disclosure in Apple operating systems allows remote observation of credentials during FaceTime screen sharing sessions. Affects iOS/iPadOS 18.x through 18.7.2, iOS/iPadOS 26.0-26.1, macOS Sequoia through 15.7.2, macOS Tahoe through 26.1, and visionOS through 26.1. Attackers with network access to FaceTime sessions can view password fields that should be masked, creating credential exposure risk during remote support or collaboration scenarios. EPSS score of 0.03% (10th percentile) indicates low automated exploitation probability, and no public exploit identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) in Apple's state management implementation for password field rendering during FaceTime-based remote control sessions. When a user shares their screen or allows remote control via FaceTime, the system should mask password input fields to prevent visual disclosure. The flaw in state management causes password fields to render in cleartext instead of being properly obfuscated during these remote sessions. This affects multiple Apple platforms sharing common UI rendering frameworks: iOS/iPadOS, macOS (both Sequoia and Tahoe releases), and visionOS. The vulnerability resides in the interaction layer between FaceTime's screen sharing protocol and the operating system's secure input handling mechanisms, suggesting a race condition or improper state transition when switching between local and remote display contexts.

RemediationAI

Apply vendor-released patches immediately for devices using FaceTime screen sharing features. Upgrade iOS and iPadOS devices to version 18.7.3 or 26.2 (depending on major version branch), macOS Sequoia systems to version 15.7.3, macOS Tahoe systems to version 26.2, and visionOS devices to version 26.2. Apple addressed the vulnerability through improved state management in password field rendering during remote sessions. Deployment instructions and security content details are available in Apple support articles at https://support.apple.com/en-us/125884, https://support.apple.com/en-us/125885, https://support.apple.com/en-us/125886, https://support.apple.com/en-us/125887, and https://support.apple.com/en-us/125891. Organizations unable to patch immediately should implement compensatory controls: prohibit password entry during FaceTime screen sharing sessions, require users to pause screen sharing before accessing password-protected resources, use password managers with clipboard-based autofill instead of visible typing, and educate users about the risk of credential exposure during remote support sessions.