Actively exploited in the wild
Apple Multiple Products Unspecified Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2025-06-16. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-43200
MediumCVSS 4.2KEVSummary
A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. This issue is fixed in iOS 15.8.4, iPadOS 15.8.4, iOS 16.7.11, iPadOS 16.7.11, iOS 18.3.1, iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, and watchOS 11.3.1. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
Risk Assessment
The risk includes potential exploitation in targeted attacks, which could lead to privacy breach or device compromise.
Recommendation
Immediately update Apple systems to the latest versions listed in the description and exercise caution when opening iCloud links from unknown senders.
Other vulnerabilities in Apple iOS/iPadOS/macOS/visionOS/watchOS
See all- CVE-2026-84625Critical
A permissions issue was addressed with additional sandbox restrictions. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may be able to fingerprint the user.
- CVE-2026-86870Medium
A heap buffer overflow was addressed with improved bounds checking. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. Processing a maliciously crafted file may lead to unexpected app termination.
- CVE-2026-65412Medium
A null pointer dereference vulnerability in Apple systems, fixed with improved input validation. Processing web content may lead to a denial-of-service.
- CVE-2026-65403Medium
This issue was addressed with improved checks. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may be able to access sensitive user data.
- CVE-2026-65399Medium
A file quarantine bypass was addressed with additional checks. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. An archive may be able to bypass Gatekeeper.
- CVE-2026-64734Medium
A vulnerability in Apple systems, fixed with improved checks. Processing a maliciously crafted contact may leak sensitive data.
Original NVD description (English source)
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.