CVE-2025-43200: Apple Multiple Products logic issue in iCloud Link media processing

CVE-2025-43200 · Severity: critical · CVSS 4.2 · Exploited in the wild · Published 2025-06-16

A security vulnerability exists in Apple's operating systems (iOS, macOS, iPadOS, watchOS, and visionOS) when handling media shared through iCloud Links. An attacker could use a specially crafted photo or video to compromise a user's device if the user interacts with the malicious link. This flaw has been reportedly used in highly targeted attacks against specific individuals, such as journalists, to deploy spyware.

Technologies: Apple iPadOS, Apple macOS, Apple Multiple Products, Apple Visionos, Apple watchOS. Vendors: Apple.

Quick answers

Is CVE-2025-43200 exploited in the wild?
Yes. CVE-2025-43200 is known to be exploited in the wild, first recorded on 16 June 2025. Treat it as urgent.
How severe is CVE-2025-43200?
Critical severity, with a CVSS score of 4.2, published 16 June 2025.
Which products and versions are affected?
Apple iPadOS < 15.8.4, 16.0 - 16.7.11, 17.0 - 17.7.5, 18.0 - 18.3.1; Apple macOS Ventura < 13.7.4, Sonoma < 14.7.4, Sequoia < 15.3.1; Apple Visionos < 2.3.1; Apple watchOS < 11.3.1.
Is there a fix for CVE-2025-43200?
A patch was published on 2025-06-16: Fixed in iOS 18.3.1, macOS 15.3.1, and other concurrent releases Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-43200 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2025-43200?
Check whether you run Apple iPadOS, Apple macOS, Apple Multiple Products or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic issue exists in the way Apple operating systems process media content shared via iCloud Links. The vulnerability is triggered when a user interacts with a maliciously crafted photo or video file. While technical specifics of the 'logic issue' are unspecified by the vendor, it allows for unauthorized actions or data access on the target device. This vulnerability has been observed in the wild as part of a sophisticated exploit chain used to deliver mercenary spyware. Apple addressed the issue by implementing improved checks in the media processing components.

Affected products

  • Apple iOS < 15.8.4, 16.0 - 16.7.11, 17.0 - 18.3.1
  • Apple iPadOS < 15.8.4, 16.0 - 16.7.11, 17.0 - 17.7.5, 18.0 - 18.3.1
  • Apple macOS Ventura < 13.7.4, Sonoma < 14.7.4, Sequoia < 15.3.1
  • Apple visionOS < 2.3.1
  • Apple watchOS < 11.3.1

Timeline

  • 2025-06-16: disclosed
  • 2025-06-16: kev added: Added to CISA KEV catalog
  • 2025-06-16: patched: Fixed in iOS 18.3.1, macOS 15.3.1, and other concurrent releases
  • 2025-06-16: exploited: Reported as exploited in targeted attacks against individuals

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.