5.5med
CVE-2025-46292
This issue was addressed with additional entitlement checks.
Published 10 mo ago · modified 4 mo ago · JSON
CVSS
5.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.1%
percentile 3%
Public exploits
0
none known
Summary
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able to access user-sensitive data.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction (EPSS)
0.14% probability of exploitation in the next 30 days, higher than 3% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Affected products
- Apple iOS and iPadOS
Classification
- Weakness
- CWE-284 Improper Access Control
References
- support.apple.com /en-us/125884
- support.apple.com /en-us/125885
Sources
- CVE List: CVE-2025-46292
- NVD: CVE-2025-46292
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.