cbcvebase.
CVE-2025-43200
published 2025-06-16

CVE-2025-43200: This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS…

PriorityP279medium4.2CVSS 3.1
AVNACHPRNUIRSUCLILAN
KEVITW
CISA Known Exploited Vulnerabilitydue 2025-07-07
Exploited in the wild
EPSS
1.01%
59.2th percentile
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Affected

28 ranges· showing 25
VendorProductVersion rangeFixed in
appleios_15.8.4_and_ipados
appleios_16.7.11_and_ipados
appleios_18.3.1_and_ipados
appleios_and_ipados< 15.8.415.8.4
appleios_and_ipados< 16.7.1116.7.11
appleios_and_ipados< 18.3.118.3.1
appleipados< 17.7.517.7.5
appleipados< 15.8.415.8.4
appleipados
appleipados>= 16.0 < 16.7.1116.7.11
appleipados>= 17.0 < 17.7.517.7.5
appleipados>= 18.0 < 18.3.118.3.1
appleiphone_os< 15.8.415.8.4
appleiphone_os16.0 – 16.7.11
appleiphone_os17.0 – 18.3.1
applemacos< 13.7.413.7.4
applemacos< 14.7.414.7.4
applemacos< 15.3.115.3.1
applemacos>= 13.0 < 13.7.413.7.4
applemacos>= 14.0 < 14.7.414.7.4
applemacos>= 15.0 < 15.3.115.3.1
applemacos_sequoia
applemacos_sonoma
applemacos_ventura
applevisionos< 2.3.12.3.1

Detection & IOCsextracted from sources · hover to see the quote

ip46.183.184.91
  • Post-exploitation, Graphite spyware beacons out to a C2 server. Monitor for outbound connections from iOS/macOS devices to 46.183.184.91 (EDIS Global VPS) as an indicator of compromise.
  • Targeted devices were running iOS 18.2.1 at time of exploitation; devices on iOS versions prior to 18.3.1 (patched February 10) remain vulnerable. Prioritize detection/patching on unpatched iOS/iPadOS/macOS endpoints.
  • ·The C2 IP (46.183.184.91) was only confirmed active until April 12; infrastructure may have rotated since then.
  • ·Apple has not confirmed whether CVE-2025-43200 can be exploited on devices with Lockdown Mode enabled, leaving uncertainty about its effectiveness as a full mitigation.

CVSS provenance

nvdv3.14.2MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
vulncheck4.2MEDIUM
cisa4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.