CVE-2025-43203

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-15 · updated 2026-06-17
Weakness: CWE-922

Description

The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An attacker with physical access to an unlocked device may be able to view an image in the most recently viewed locked note.

Affected products

Apple iPadOS: before 18.7 — fixed in 18.7
Apple Iphone Os: before 18.7 — fixed in 18.7

How to fix

Upgrade to a fixed version: Apple iPadOS 18.7; Apple Iphone Os 18.7. Check the vendor advisory for mitigations.

References

https://support.apple.com/en-us/125108
https://support.apple.com/en-us/125109
http://seclists.org/fulldisclosure/2025/Sep/49
http://seclists.org/fulldisclosure/2025/Sep/50

Get alerted when CVE-2025-43203 or the next vulnerability affects your stack