Is CVE-2025-43362 being actively exploited?

CVE-2025-43362 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2025-43362?

CVE-2025-43362 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2025-43362

CRITICAL · CVSS 9.8EPSS 1.1%EU EUVD

The issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An app may be able to monitor keystrokes without user permission.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-200
EPSS score: 1.1% (65th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2025-29303)
Published: September 15, 2025
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-29303 in the EU Vulnerability Database. Last updated in EUVD on April 2, 2026.

View on the EU Vulnerability Database

Affected products

apple / ipados
apple / iphone os

Certified products that may be affected

13 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Apple iOS 18: iPhone - Apple Inc. - Common Criteria CCEVS-VR-VID-11623-2025 - active
Apple iPadOS 18: iPad - Apple Inc. - Common Criteria CCEVS-VR-VID-11624-2025 - active
Apple iPadOS 17: iPad - Apple Inc. - Common Criteria CCEVS-VR-VID-11447-2025 - active
Strong Customer Authentication for Apple Pay on iPhone 14 Pro with A16 Bionic running iOS 16.4.1Version iOS 16.4.1 (build 20E252) ( ANSSI-CC-2023/59) - Apple Inc. - Common Criteria ANSSI-CC-2023/59 - active
Strong Customer Authentication for Apple Pay on iPhone SE (3rd generation) with A15 Bionic running iOS 16.4.1iOS 16.4.1 (build 20E252) (ANSSI-CC-2023/58) - Apple Inc. - Common Criteria ANSSI-CC-2023/58 - active

See all 13 in the Security Certifications Explorer.

References

http://seclists.org/fulldisclosure/2025/Sep/49
http://seclists.org/fulldisclosure/2025/Sep/50
https://support.apple.com/en-us/125108(Release Notes, Vendor Advisory)
https://support.apple.com/en-us/125109(Release Notes, Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain