Security readout for executives and security teams
Plain-English summary
CVE-2025-43200 is an Apple logic flaw triggered by a malicious photo or video shared through an iCloud Link. Apple says it may have been used in an extremely sophisticated attack against specific individuals. The issue is patched across iOS, iPadOS, macOS, visionOS, and watchOS, so exposed devices should be updated quickly.
Executive priority
Treat this as urgent targeted-spyware risk, not routine medium-severity hygiene. Patch Apple fleets promptly, starting with high-risk personnel and unmanaged devices. Business impact is concentrated around sensitive communications, executive exposure, and reputational risk if targeted users remain behind on Apple security updates.
Technical view
The flaw involves insufficient checks while processing crafted photo or video content shared via iCloud Link. CVSS is 4.2 because exploitation requires user interaction and high complexity, with limited confidentiality and integrity impact. CISA KEV listing and Apple’s exploitation statement make it operationally important despite the medium base score.
Likely exposure
Organizations with unmanaged or outdated Apple devices are exposed, especially executives, journalists, legal teams, activists, and other targeted users. Affected families include iOS, iPadOS, macOS, visionOS, and watchOS before Apple’s fixed releases. The source data does not identify a broad mass-exploitation campaign.
Exploitation context
Active exploitation is supported by CISA KEV and Apple’s statement that exploitation may have occurred in an extremely sophisticated attack against targeted individuals. Citizen Lab reporting links the case context to mercenary spyware targeting journalists. Public sources do not provide technical exploit details, indicators, or broad targeting metrics here.
Researcher notes
The bundle supports exploitation status but provides limited technical detail. Avoid inferring the vulnerable component, exact exploit chain, or detection logic beyond iCloud Link media processing. Validation should focus on version state, high-risk user exposure, and vendor or trusted forensic guidance rather than public exploit reproduction.
Mitigation direction
- Update iOS and iPadOS to 15.8.4, 16.7.11, or 18.3.1 as applicable.
- Update iPadOS 17 devices to iPadOS 17.7.5.
- Update macOS to Sequoia 15.3.1, Sonoma 14.7.4, or Ventura 13.7.4.
- Update visionOS to 2.3.1 and watchOS to 11.3.1 where applicable.
- Prioritize patching high-risk users and devices outside centralized management.
- Check Apple and CISA guidance for any additional remediation instructions.
Validation and detection
- Inventory Apple devices and compare OS versions against Apple’s fixed release list.
- Use MDM reporting to confirm installation status and identify unsupported or unmanaged devices.
- Prioritize validation for executives, journalists, legal staff, and other likely targeted users.
- Review Apple, MDM, and security telemetry for relevant alerts without assuming compromise.
- Track the CISA KEV entry for required remediation timelines and updates.
Public sources used
- CVE Program
- CVE List V5
- Apple Security Release 122173
- Apple Security Release 122174
- Apple Security Release 122345
- Apple Security Release 122346
- Apple Security Release 122900
- Apple Security Release 122901
- Apple Security Release 122902
- Apple Security Release 122903
- Citizen Lab Paragon spyware report
- CISA Known Exploited Vulnerabilities Catalog
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-43200 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.2 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N1.62.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.2MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/122173CVE reference
- https://support.apple.com/en-us/122174CVE reference
- https://support.apple.com/en-us/122345CVE reference
- https://support.apple.com/en-us/122346CVE reference
- https://support.apple.com/en-us/122900CVE reference
- https://support.apple.com/en-us/122901CVE reference
- https://support.apple.com/en-us/122902CVE reference
- https://support.apple.com/en-us/122903CVE reference
- https://support.apple.com/en-us/122904CVE reference
- https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43200CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.