← Back

CVE-2025-43280

nvd nist
Published: Oct 15, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.7
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The issue was resolved by not loading remote images. This issue is fixed in iOS 18.6 and iPadOS 18.6. Forwarding an email could display remote images in Mail in Lockdown Mode.

Affected (2)

Products: Apple: Ipados, Iphone Os
Apple
2 products
Ipados
Iphone Os
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Ipados
Before 18.6
Iphone Os
Before 18.6

Related CWEs

CWE-940
Improper Verification of Source of a Communication Channel
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

References (1)

Source: product-security@apple.com
Release NotesVendor Advisory

Timeline

No history available yet.