CVE-2025-43542CWE-200information-disclosure

CVE-2025-43542

High · published December 13, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

⚡ Ever thought your FaceTime could spill your secrets? This vulnerability allows password fields to be accidentally revealed during remote controls, making it a sneaky security concern! 🔥 Imagine a hotel room with a big window that you forgot to close while dialing room service—anyone walking by can catch a glimpse of your personal items. That’s exactly how this flaw works, showcasing sensitive information at the most unexpected moments! This means that someone could potentially see your passwords while you're managing your device over FaceTime, leaving your sensitive data exposed! The consequences could be absolutely devastating, especially if those passwords grant access to important accounts or systems.

Put simply

Imagine a hotel room with a big window that you forgot to close while dialing room service—anyone walking by can catch a glimpse of your personal items. That’s exactly how this flaw works, showcasing sensitive information at the most unexpected moments! This vulnerability involves improper state management during FaceTime sessions, which may unintentionally display password fields to users controlling a device remotely, risking exposure of sensitive information.

What to do

This means that someone could potentially see your passwords while you're managing your device over FaceTime, leaving your sensitive data exposed! The consequences could be absolutely devastating, especially if those passwords grant access to important accounts or systems. To protect yourself, update your devices to the latest versions: iOS 18.7.3, iPadOS 18.7.3, macOS Sequoia 15.7.3, or macOS Tahoe 26.2. Implement regular updates as part of your routine to stay ahead of any potential vulnerabilities. You've got this! Stay vigilant and keep your devices secure! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00857 · 58.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-12-13T02:15Z
Affected products (1)
ProductVersionsFixed in
apple/macos< 15.7.315.7.3
References (5)
EPSS history
Timeline
  • 12 DEC 20:56Z
    This issue was addressed with improved state management
    cvelistv5