Configuration Issue in Apple Products Enables Unauthorized Access
CVE-2025-43428

9.8CRITICAL

Key Information:

Vendor

Apple
Status
iOS And iPad OS
Visionos
Mac OS
Vendor
CVE Published:
17 December 2025

What is CVE-2025-43428?

A configuration issue was identified that could allow unauthorized access to photos in the Hidden Photos Album on affected Apple devices. This vulnerability has been addressed in the latest updates for visionOS, iOS, iPadOS, and macOS, where additional restrictions have been implemented to enhance security. Users are urged to update to the latest version to mitigate potential risks associated with this vulnerability.

Affected Version(s)

iOS and iPadOS < 26.2

macOS < 26.2

visionOS < 26.2

References

https://support.apple.com/en-us/125884
https://support.apple.com/en-us/125891
https://support.apple.com/en-us/125886

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-43428 : Configuration Issue in Apple Products Enables Unauthorized Access