CVERadar
MEDIUM · CVSS 3.1 4.2CISA KEV · added 2025-06-16EPSS 1.19% (p68)Threat level 36

CVE-2025-43200: Apple Multiple Products Unspecified Vulnerability

Apple · Multiple Products · NVD published 2025-06-17 · posted 2025-06-16 · last modified 2026-09-24

What it is

This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

WeaknessNot specified
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N (source: 134c704f-9b21-4f2e-91b3-4a467353bcc0)
CISA due date2025-07-07 (for US federal agencies under BOD; a good deadline for everyone)
ATT&CK tacticsExecution → Collection → Command and Control

Exploitation evidence

First exploit evidence seen: 2025-06-16 (earliest date across the sources below).

Exploited in the wild

  • CISA KEV: listed since 2025-06-16. Source

Sources: CISA KEV.

Defend the Chain

The attack chain for CVE-2025-43200 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.

Threat level 36/100
Defender level 1 · 0 XP
Chain links broken: 0/3

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Pick a red technique card on the board, then choose the defence that stops it.

Defend against T1203 Exploitation for Client Execution CTID: exploitation technique

A zero-click attack leveraging this vulnerability involves sending a maliciously crafted photo or video in an iCloud link via the Messages app. Reports indicate that the targeted devices are then compromised with Paragon's Graphite spyware.

How to fix it

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

  • apple ipados: upgrade to 15.8.4 or later
  • apple ipados: upgrade to 16.7.11 or later (affected from 16.0)
  • apple ipados: upgrade to 17.7.5 or later (affected from 17.0)
  • apple ipados: upgrade to 18.3.1 or later (affected from 18.0)
  • apple iphone os: upgrade to 15.8.4 or later
  • apple macos: upgrade to 13.7.4 or later (affected from 13.0)
  • apple macos: upgrade to 14.7.4 or later (affected from 14.0)
  • apple macos: upgrade to 15.3.1 or later (affected from 15.0)
  • apple visionos: upgrade to 2.3.1 or later
  • apple watchos: upgrade to 11.3.1 or later

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

MITRE ATT&CK mitigations for this chain

  • M1050 Exploit Protection (for T1203) : Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploi
  • M1051 Update Software (for T1203) : Perform regular software updates to mitigate exploitation risk. Keeping software up-to-date with the latest security patches helps prevent adversaries from exploiting known vulnerabilities in client software, reducing the risk of successful attacks.
  • M1048 Application Isolation and Sandboxing (for T1203) : Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. Risks of additional exploits and weaknesses in those systems may still exist.
  • M1057 Data Loss Prevention (for T1005) : Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.
  • M1031 Network Intrusion Prevention (for T1105) : Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on
  • M1037 Filter Network Traffic (for T1105) : Use network filtering to block outbound traffic from compromised systems to unapproved external destinations. Restricting access to known, trusted IP addresses and protocols can prevent attackers from downloading malicious tools or payloads onto compromised servers after gaining initial access.

Detection Generic guidance

  • Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.
  • Collection: Watch for bulk reads of databases, file shares or mailboxes by the affected service.
  • Command and Control: Alert on outbound connections from the server to new or rare destinations.

Response checklist Generic guidance

  1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
  2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
  3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
  4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

Sources