CVE-2025-43498

Vulnerability

Details

CVE-2025-43498 is an authorization issue in Apple's state management logic. The bug arises from improper handling of authorization states, which could allow an app to bypass permission checks and access sensitive user data. Apple addressed the issue with improved state management in the latest updates [1][2][3][4].

Exploitation

An attacker would need to have a malicious or compromised app installed on the target device. The vulnerability is exploitable locally without requiring network access or user interaction beyond the initial app installation. The exact attack vector is not publicly detailed, but the flaw resides in the authorization framework common to iOS, iPadOS, macOS, and visionOS [1][2][3][4].

Impact

Successful exploitation could allow an app to access sensitive user data, such as personal information, documents, or data from other apps. The CVSS v3 score of 5.5 (Medium) reflects the potential for confidentiality impact without requiring high privileges or complex attack scenarios.

Mitigation

Apple has released patches for all affected platforms: iOS 26.1 and iPadOS 26.1 [1], macOS Sequoia 15.7.2 [3], macOS Sonoma 14.8.2 [4], macOS Tahoe 26.1 [2], and visionOS 26.1. Users are strongly advised to update their devices to the latest available versions. No workarounds have been provided.