Vulnerability record · CVE-2025-43200 · published 16 June 2025
CVE-2025-43200: Apple iOS, iPadOS, macOS, visionOS, watchOS iCloud Link photo/video logic flaw
Apple · Ipados
A logic issue in how Apple platforms process a maliciously crafted photo or video shared via an iCloud Link allows an attacker to trigger unintended behavior. Apple states the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals, and CISA added it to KEV on 2025-06-16. The record gives no root-cause detail beyond 'improved checks' and an unspecified CWE.
Description
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Automated analysis
high priorityCVSS is only medium (4.2) but the flaw is in CISA KEV with confirmed targeted exploitation, which raises urgency above the base score.
What it is
A logic issue in how Apple platforms process a maliciously crafted photo or video shared via an iCloud Link allows an attacker to trigger unintended behavior. Apple states the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals, and CISA added it to KEV on 2025-06-16. The record gives no root-cause detail beyond 'improved checks' and an unspecified CWE.
Impact
Successful exploitation yields limited confidentiality and integrity impact (CVSS 3.1 4.2, C:L/I:L), consistent with a targeted spyware-style attack rather than mass compromise. The attacker gains the ability to affect processing of shared media on the victim device, not full system control per the published score.
Attack surface
Reached over the network via a crafted photo or video delivered through an iCloud Link; the vector is AV:N/AC:H/PR:N/UI:R, so no authentication is required but user interaction (opening or viewing the shared media) is needed. Attack complexity is rated high.
Exploitation
Listed in CISA KEV with a 2025-07-07 remediation due date, and Apple acknowledges a report of exploitation in an extremely sophisticated attack against specific targeted individuals. EPSS 30-day probability is 0.01037 (62nd percentile), and references include vendor advisories plus Citizen Lab press coverage; no ransomware use is documented.
What to do
- Update to the fixed versions: iOS/iPadOS 15.8.4, 16.7.11, 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, Sonoma 14.7.4, Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1.
- Prioritize patching devices belonging to at-risk individuals (journalists, activists, executives) given the targeted exploitation report.
- Treat unsolicited iCloud Link media from unknown senders as untrusted; avoid opening such links until devices are patched.
- Follow CISA BOD 22-01 guidance for cloud services and apply vendor mitigations or discontinue affected products where patching is not possible.
- Verify patch state across all listed platforms, including older iOS/iPadOS branches that received backported fixes.
Detection
- Inventory devices and confirm OS build versions against the fixed releases listed in Apple advisories 122173, 122174, 122345, 122346, 122900-122904.
- Monitor for iCloud Link media delivery to targeted users and correlate with any anomalous process or network activity on those devices.
- Review endpoint telemetry for unexpected behavior following receipt or viewing of shared photos or videos on Apple devices.
- Track KEV status and re-scan for unpatched Apple devices before the 2025-07-07 due date.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-43200 to the Known Exploited Vulnerabilities catalog on 16 June 2025 as "Apple Multiple Products Unspecified Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 7 July 2025.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://support.apple.com/en-us/122173 | Vendor Advisory |
| https://support.apple.com/en-us/122174 | Vendor Advisory |
| https://support.apple.com/en-us/122345 | Vendor Advisory |
| https://support.apple.com/en-us/122346 | Vendor Advisory |
| https://support.apple.com/en-us/122900 | Vendor Advisory |
| https://support.apple.com/en-us/122901 | Vendor Advisory |
| https://support.apple.com/en-us/122902 | Vendor Advisory |
| https://support.apple.com/en-us/122903 | Vendor Advisory |
| https://support.apple.com/en-us/122904 | Vendor Advisory |
| https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/ | Press/Media Coverage |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43200 | US Government Resource |
Track CVE-2025-43200 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-43200), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
