CVE-2025-43203
📋 TL;DR
This vulnerability allows an attacker with physical access to an unlocked iOS/iPadOS device to view an image from the most recently viewed locked note due to improper cache handling. It affects users running vulnerable versions of iOS/iPadOS who use the Notes app with locked notes containing images. The issue is limited to devices that are physically accessible while unlocked.
💻 Affected Systems
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
An attacker with brief physical access to an unlocked device could view sensitive images from locked notes, potentially exposing confidential or personal information.
Likely Case
Limited exposure of a single cached image from locked notes when someone briefly accesses an unlocked device, with no persistent access or data exfiltration.
If Mitigated
No impact if devices are kept locked when unattended or if the vulnerability is patched.
🎯 Exploit Status
Exploitation requires physical access to an unlocked device and knowledge of how to trigger the cache issue. No authentication bypass is involved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 26, iPadOS 26, iOS 18.7, iPadOS 18.7
Vendor Advisory: https://support.apple.com/en-us/125108
Restart Required: No
Instructions:
1. Open Settings app. 2. Tap General. 3. Tap Software Update. 4. Install available update to iOS 26/iPadOS 26 or iOS 18.7/iPadOS 18.7 or later.
🔧 Temporary Workarounds
Lock device when unattended
allAlways lock your device with passcode/Touch ID/Face ID when not in use to prevent physical access.
Avoid leaving sensitive images in locked notes
allTemporarily move sensitive images out of locked notes until patched.
🧯 If You Can't Patch
- Implement strict physical security policies requiring devices to be locked when unattended
- Educate users about the risk and train them to avoid leaving devices unlocked
🔍 How to Verify
Check if Vulnerable:
Check iOS/iPadOS version in Settings > General > About > Version. If version is earlier than iOS 26, iPadOS 26, iOS 18.7, or iPadOS 18.7, device is vulnerable.Check Version:
Settings > General > About > Version (no CLI command available on iOS/iPadOS)Verify Fix Applied:
After updating, verify version shows iOS 26, iPadOS 26, iOS 18.7, iPadOS 18.7 or later in Settings > General > About > Version.📡 Detection & Monitoring
Log Indicators:
- No specific log indicators as this is a local cache issue
Network Indicators:
- No network indicators as this is a local physical access vulnerability
SIEM Query:
Not applicable - local physical access vulnerability