CVE-2025-43280: Apple iPadOS Mail Information Disclosure

CVE-2025-43280 Overview

CVE-2025-43280 is a privacy weakness in the Apple Mail application on iOS and iPadOS. When a user forwarded an email while Lockdown Mode was active, Mail could still load remote images embedded in the message. Lockdown Mode is designed to block remote content precisely to prevent sender tracking and remote fingerprinting. Apple resolved the issue in iOS 18.6 and iPadOS 18.6 by preventing remote image loading in the forwarding flow. The flaw is categorized under [CWE-940] (Improper Verification of Source of a Communication Channel).

Critical Impact
Remote images loaded during email forwarding could leak client metadata such as IP address, user agent, and read confirmation to the original sender, defeating a core Lockdown Mode guarantee.

Affected Products

Apple iOS prior to 18.6
Apple iPadOS prior to 18.6
Mail application with Lockdown Mode enabled

Discovery Timeline

2025-10-15 - CVE-2025-43280 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43280

Vulnerability Analysis

The vulnerability resides in how the Mail client handles remote content during the email forwarding operation. Lockdown Mode enforces a strict policy that suppresses remote resource loading in incoming and outgoing messages. The forwarding code path did not consistently apply this policy, allowing HTML <img> tags referencing external URLs to trigger network requests. The fix removes remote image loading during forwarding, aligning the behavior with the broader Lockdown Mode contract.

Root Cause

The root cause is a missing enforcement check in the message composition pipeline used when forwarding messages. Remote image URLs in the original message body were rendered without validating that Lockdown Mode should suppress them. This is a policy enforcement gap rather than a memory safety or code execution defect.

Attack Vector

An attacker sends a crafted HTML email containing tracking pixels or externally hosted images to a target running iOS or iPadOS with Lockdown Mode enabled. When the recipient forwards the message, the Mail client fetches the remote resources. The attacker-controlled server logs the request, disclosing information such as source IP address, approximate location, and the fact that the message was handled. Exploitation requires user interaction, specifically the act of forwarding the email.

No public proof-of-concept or exploit code has been released for this issue. The vulnerability mechanism is described in the Apple Support Document.

Detection Methods for CVE-2025-43280

Indicators of Compromise

Outbound HTTP or HTTPS requests from iOS or iPadOS devices to unknown image-hosting domains immediately after a user forwards an email.
Presence of tracking pixel URLs (single-pixel images, unique per-recipient tokens in query strings) inside forwarded mail bodies.
Mail traffic patterns from Lockdown Mode users to third-party content delivery networks that should have been blocked.

Detection Strategies

Inspect corporate mail gateway logs for inbound messages containing remote <img> tags with per-recipient tracking parameters.
Correlate mobile device network telemetry with email client activity to identify remote content fetches occurring during forwarding.
Audit endpoints with Lockdown Mode enabled to confirm they are running iOS or iPadOS 18.6 or later.

Monitoring Recommendations

Enable DNS and TLS SNI logging on mobile network egress points to flag connections to known tracker domains.
Monitor mobile device management (MDM) inventory for iOS and iPadOS versions below 18.6 among users who rely on Lockdown Mode.
Track user reports of unexpected remote content rendering in Mail after forwarding messages.

How to Mitigate CVE-2025-43280

Immediate Actions Required

Update all iPhone and iPad devices to iOS 18.6 or iPadOS 18.6 or later through Settings, General, Software Update.
Prioritize updates for users who rely on Lockdown Mode, including journalists, executives, and high-risk personnel.
Verify Lockdown Mode remains enabled after the update by checking Settings, Privacy & Security, Lockdown Mode.

Patch Information

Apple released fixes in iOS 18.6 and iPadOS 18.6. The patch resolves the issue by not loading remote images during message forwarding. Details are available in the Apple Support Document.

Workarounds

Avoid forwarding untrusted HTML email from devices running versions earlier than iOS 18.6 or iPadOS 18.6.
Forward messages as plain text where possible, or copy the relevant content into a new message body before sending.
Use a mail gateway that strips or rewrites remote image URLs before delivery to Lockdown Mode users.

bash

# Verify iOS/iPadOS version on managed devices via MDM query
# Example: check that ProductVersion is 18.6 or higher
mdm query --device-id <id> --key ProductVersion