CVE-2025-43220

Key facts

CVSS score

9.8 (v3.1)

Severity

CRITICAL

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness (CWE)

CWE-59

EPSS score

0.8% (57th percentile)

In CISA KEV

No

In EU EUVD

Yes (EUVD-2025-23108)

Published

July 30, 2025

NVD last modified

June 17, 2026

Status

Modified

Affected products

• apple / ipados
• apple / macos

Certified products that may be affected

21 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Apple macOS 15 Sequoia - Apple Inc. - Common Criteria CCEVS-VR-VID-11648-2026 - active
• Strong Customer Authentication for Apple Pay on MacBook Air 2024 with M3running macOS Sequoia 15.4 - Apple Inc. - Common Criteria 2025-11-INF-4674 - active
• Apple macOS 14 Sonoma - Apple Inc. - Common Criteria CCEVS-VR-VID-11584-2025 - active
• Strong Customer Authentication for Apple Pay on Mac mini with M4 running macOS Sequoia 15.4, paired with Magic keyboard with Touch ID(macOS Sequoia 15.4 (build 24E248)) (ANSSI-CC-2025/36) - Apple Inc. - Common Criteria ANSSI-CC-2025/36 - active
• Apple iPadOS 17: iPad - Apple Inc. - Common Criteria CCEVS-VR-VID-11447-2025 - active

See all 21 in the Security Certifications Explorer.

References

• http://seclists.org/fulldisclosure/2025/Jul/31
• http://seclists.org/fulldisclosure/2025/Jul/32
• http://seclists.org/fulldisclosure/2025/Jul/33
• http://seclists.org/fulldisclosure/2025/Jul/34
• https://support.apple.com/en-us/124148(Release Notes, Vendor Advisory)
• https://support.apple.com/en-us/124149(Release Notes, Vendor Advisory)
• https://support.apple.com/en-us/124150(Release Notes, Vendor Advisory)
• https://support.apple.com/en-us/124151(Release Notes, Vendor Advisory)