CVE-2025-46287
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2Description
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An attacker may be able to spoof their FaceTime caller ID.
Analysis
FaceTime caller ID spoofing vulnerability in Apple operating systems allows remote attackers to spoof their caller identity due to inconsistent user interface state management. Affected versions include iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Sequoia 15.7.2 and earlier, macOS Sonoma 14.8.2 and earlier, macOS Tahoe 26.1 and earlier, visionOS 26.1 and earlier, and watchOS 26.1 and earlier. The vulnerability requires no user interaction or authentication and carries low real-world exploitation risk (EPSS 0.07%, percentile 21%), with no public exploit code or active exploitation confirmed.
Technical Context
This vulnerability stems from CWE-451 (User Interface Inconsistency), a state management flaw in Apple's FaceTime implementation across its ecosystem. The underlying issue involves improper synchronization or validation of UI state representation versus the actual caller identity data being displayed, allowing the visual presentation of caller information to become desynchronized from the authenticated identity. This affects multiple Apple platforms that share FaceTime functionality, including iOS, iPadOS, macOS variants, visionOS, and watchOS. The cross-platform nature suggests a shared vulnerability in the FaceTime framework or service layer that handles caller identification and display logic.
Affected Products
Apple's multi-platform ecosystem is affected across iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Sequoia 15.7.2 and earlier, macOS Sonoma 14.8.2 and earlier, macOS Tahoe 26.1 and earlier, visionOS 26.1 and earlier, and watchOS 26.1 and earlier. All devices running FaceTime on these operating system versions are vulnerable to caller ID spoofing. Additional details on affected products and patch status can be found in Apple's official security advisories (support.apple.com/en-us/125884, 125885, 125886, 125887, 125888, 125890, 125891).
Remediation
Vendor-released patches are available: iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, and watchOS 26.2. Users should update all Apple devices to these versions or later immediately through Settings > General > Software Update (iOS/iPadOS/watchOS), System Settings > General > Software Update (macOS), or the appropriate system update mechanism for visionOS. No workarounds are available; patching is the only remediation. Refer to Apple's security updates page and the specific advisory links (support.apple.com/en-us/125887 and 125888) for device-specific guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today