CVE-2025-43428

A configuration issue was addressed with additional restrictions

Critical · published December 17, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

🚨 A sneaky configuration issue lets anyone peek into your Hidden Photos Album without any authentication! 🔥 Think of your phone as a hotel room with a locked safe for your most sensitive belongings, but this vulnerability is like a hotel staff member who can waltz in without a key – they can check out your private photos whenever they want! An attacker could gain unauthorized access to your secret photos, exposing potentially sensitive and personal information. This breach could be absolutely devastating for users who rely on the privacy of their Hidden Photos Album, leaving their personal moments vulnerable to prying eyes.

Put simply

Think of your phone as a hotel room with a locked safe for your most sensitive belongings, but this vulnerability is like a hotel staff member who can waltz in without a key – they can check out your private photos whenever they want! This vulnerability arises from a configuration oversight that allows access to the Hidden Photos Album without the necessary authentication checks, effectively bypassing the intended privacy mechanisms.

What to do

An attacker could gain unauthorized access to your secret photos, exposing potentially sensitive and personal information. This breach could be absolutely devastating for users who rely on the privacy of their Hidden Photos Album, leaving their personal moments vulnerable to prying eyes. Upgrade your devices to iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2, or visionOS 26.2 immediately to close this security gap. Regularly review your privacy settings and ensure that no sensitive information is left exposed. 🛡️ You’ve got this! With these updates, you’ll keep your digital secrets safe and sound! ✨

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00712 · 53.0th percentile
Published
2025-12-17T20:46Z
EPSS history
Timeline
  • 17 DEC 20:46Z
    A configuration issue was addressed with additional restrictions
    cvelistv5