CVE-2025-43203: Apple iPadOS Information Disclosure Flaw

CVE-2025-43203 Overview

CVE-2025-43203 is an information disclosure vulnerability in Apple iOS and iPadOS. The flaw exists in the Notes application's cache handling and allows an attacker with physical access to an unlocked device to view an image from the most recently viewed locked note. Apple resolved the issue in iOS 18.7, iPadOS 18.7, iOS 26, and iPadOS 26 through improved cache handling. The vulnerability maps to [CWE-922: Insecure Storage of Sensitive Information]. Exploitation requires local, physical access and yields limited confidentiality impact with no integrity or availability consequences.

Critical Impact
An attacker with physical access to an unlocked device can bypass the locked-note protection and view a cached image from the most recently viewed locked note.

Affected Products

Apple iOS versions prior to 18.7
Apple iPadOS versions prior to 18.7
Apple iOS and iPadOS versions prior to 26

Discovery Timeline

2025-09-15 - CVE-2025-43203 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43203

Vulnerability Analysis

The Notes application in iOS and iPadOS supports locking individual notes to protect sensitive content behind an authentication prompt. The vulnerability arises because image data associated with a recently viewed locked note remained accessible through an application cache after the note was locked. An attacker holding an already-unlocked device can navigate to a location where the cached image is rendered without re-authenticating against the note's protection layer.

The issue is scoped to the most recently viewed locked note and does not expose historical content, text, or attachments beyond the cached image. Exploitation does not require network access, elevated privileges, or user interaction from the victim beyond leaving the device unlocked. Apple addressed the flaw through improved handling of caches, which purges or protects the residual image data associated with locked notes.

Root Cause

The underlying weakness is insecure storage of sensitive information in an application cache. Content protected by a per-note lock was retained in a cache that did not enforce the same authorization state as the note itself. When the Notes application redrew or previewed content, the cached image could be surfaced without invoking the locked-note authentication path.

Attack Vector

Exploitation requires physical access to an unlocked device. The attacker interacts with the Notes application to trigger rendering of the cached image from the most recently viewed locked note. No exploit code, tooling, or Proof-of-Concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Refer to the Apple Support Document #125108 and Apple Support Document #125109 for vendor-supplied technical context.

Detection Methods for CVE-2025-43203

Indicators of Compromise

No file-based or network indicators exist for this vulnerability because exploitation is a local user-interface action that leaves no forensic artifact in system logs.
Unexpected presence of locked-note image content visible on a shared or borrowed device may indicate that the flaw was leveraged before patching.

Detection Strategies

Inventory managed iOS and iPadOS fleets to identify devices running versions earlier than iOS 18.7, iPadOS 18.7, iOS 26, or iPadOS 26.
Correlate mobile device management (MDM) compliance data with the vendor advisory to flag non-compliant devices for remediation.

Monitoring Recommendations

Enable MDM reporting of iOS and iPadOS build numbers and generate alerts when devices fall behind the patched baseline.
Monitor Apple security release channels for follow-on advisories affecting the Notes application and cache subsystems.
Track physical-access risk indicators such as lost or stolen device reports through the enterprise mobility program.

How to Mitigate CVE-2025-43203

Immediate Actions Required

Update all iPhone and iPad devices to iOS 18.7, iPadOS 18.7, iOS 26, or iPadOS 26 or later.
Enforce a short device auto-lock interval so devices do not remain unlocked when unattended.
Require a device passcode and biometric authentication on all managed iOS and iPadOS endpoints.

Patch Information

Apple released fixes in iOS 18.7, iPadOS 18.7, iOS 26, and iPadOS 26. The vendor describes the remediation as improved handling of caches. Patch details are documented in Apple Support Document #125108 and Apple Support Document #125109.

Workarounds

Avoid leaving devices unlocked in untrusted physical environments until the update is applied.
Remove or re-lock sensitive images from Notes and consider storing high-sensitivity images in a dedicated secure vault application.
Use MDM configuration profiles to reduce the auto-lock timeout on managed devices as a compensating control.

bash

# Configuration example: Verify installed iOS/iPadOS build via MDM query
# Devices should report a build corresponding to iOS/iPadOS 18.7 or 26 (or later)
mdm query --device <device_id> --key ProductVersion
mdm query --device <device_id> --key BuildVersion