CVE-2025-43450CWE-284broken-access-control

CVE-2025-43450

High · published November 4, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

⚡ A crafty logic flaw could let apps peek into your camera view before they even ask for access! 📸 Think of it like a waiter sneaking a look at your table's order before you even place it—information gathered without permission! If exploited, an app could potentially gather sensitive information from your camera view, giving away private moments before you're ready to share. This could lead to an absolute invasion of privacy, making it essential to take this issue seriously.

Put simply

Think of it like a waiter sneaking a look at your table's order before you even place it—information gathered without permission! This vulnerability arises from a logic issue that allows apps to gain insights into the current camera view even when they haven't been granted the appropriate access. Improved checks have been introduced to mitigate this risk in updated versions of iOS and iPadOS.

What to do

If exploited, an app could potentially gather sensitive information from your camera view, giving away private moments before you're ready to share. This could lead to an absolute invasion of privacy, making it essential to take this issue seriously. Update your devices to iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, or iPadOS 26.1 to close this loophole. Regularly review permissions granted to apps to ensure they align with your privacy preferences. You've got this—stay vigilant and keep your devices updated for maximum security! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-11-04T07:15Z
Affected products (2)
ProductVersionsFixed in
apple/ipados< 26.126.1
apple/iphone_os< 26.126.1
References (2)
EPSS history
Timeline
  • 04 NOV 01:17Z
    A logic issue was addressed with improved checks
    cvelistv5