CVE-2025-43350
📋 TL;DR
This CVE describes a lock screen bypass vulnerability in Apple iOS/iPadOS where an attacker with physical access to a locked device could view restricted content. It affects iOS/iPadOS versions before 26.1. The vulnerability requires physical device access to exploit.
💻 Affected Systems
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access could view sensitive information displayed on the lock screen, potentially exposing private messages, notifications, or app content without authentication.
Likely Case
Someone with brief physical access to a locked device (e.g., coworker, family member) could view notifications or limited content visible from the lock screen.
If Mitigated
With proper physical security controls and updated software, the risk is minimal as the vulnerability requires physical device access.
🎯 Exploit Status
Exploitation requires physical access to a locked device. No authentication or special privileges needed once physical access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 26.1, iPadOS 26.1
Vendor Advisory: https://support.apple.com/en-us/125632
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Go to General > Software Update. 3. Download and install iOS/iPadOS 26.1 update. 4. Device will restart automatically.
🔧 Temporary Workarounds
Disable Lock Screen Notifications
allPrevent sensitive information from appearing on lock screen by disabling notification previews.
Enable Stronger Lock Screen Security
allUse longer passcodes and enable Face ID/Touch ID with attention awareness features.
🧯 If You Can't Patch
- Implement strict physical security controls for devices
- Disable all lock screen notifications and sensitive content display
🔍 How to Verify
Check if Vulnerable:
Check iOS/iPadOS version in Settings > General > About. If version is earlier than 26.1, device is vulnerable.Check Version:
Not applicable - check via device Settings interfaceVerify Fix Applied:
After updating, verify version shows iOS/iPadOS 26.1 or later in Settings > General > About.📡 Detection & Monitoring
Log Indicators:
- Unusual device unlock patterns or failed authentication attempts
Network Indicators:
- None - this is a local physical access vulnerability
SIEM Query:
Not applicable for network detection as this requires physical access