7.5high
CVE-2025-43500
A privacy issue was addressed with improved handling of user preferences.
Published 12 mo ago · modified 21 d ago · JSON
CVSS
7.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 45%
Public exploits
0
none known
Summary
A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to access sensitive user data.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction (EPSS)
0.52% probability of exploitation in the next 30 days, higher than 45% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Apple iOS and iPadOS
- Apple macOS
- Apple visionOS
- Apple watchOS
Classification
- Weakness
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
References
- support.apple.com /en-us/125632
- support.apple.com /en-us/125634
- support.apple.com /en-us/125638
- support.apple.com /en-us/125639
Sources
- CVE List: CVE-2025-43500
- NVD: CVE-2025-43500
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.