CVE-2025-43452 Overview
CVE-2025-43452 is an information disclosure vulnerability affecting Apple iOS and iPadOS. Keyboard suggestions may display sensitive information on the lock screen of an affected device. Apple addressed the issue by restricting options offered on a locked device.
The flaw requires physical access to a locked iPhone or iPad. An attacker in possession of the device could observe cached keyboard suggestions containing private user data without unlocking the device. Apple fixed the issue in iOS 26.1 and iPadOS 26.1.
Critical Impact
An attacker with physical access to a locked iOS or iPadOS device can view sensitive information exposed through keyboard suggestions on the lock screen [CWE-359].
Affected Products
- Apple iOS (versions prior to 26.1)
- Apple iPadOS (versions prior to 26.1)
- Apple iPhone and iPad devices running vulnerable OS versions
Discovery Timeline
- 2025-11-04 - CVE-2025-43452 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43452
Vulnerability Analysis
The vulnerability falls under [CWE-359] Exposure of Private Personal Information to an Unauthorized Actor. On affected iOS and iPadOS versions, the keyboard suggestion bar could surface previously typed text, including sensitive strings such as one-time passcodes, credentials, or personal messages, while the device remained locked.
Keyboard predictive text and autocomplete functionality caches recent user input to improve typing accuracy. When surfaced in interactive contexts available from the lock screen, such as reply-from-notification interfaces, this cache may present sensitive strings to anyone with physical access to the device.
Apple's fix restricts the options offered on a locked device, limiting the surfaces where keyboard suggestions can appear before authentication. Exploitation is limited to physical proximity and requires no user interaction from the legitimate owner.
Root Cause
The underlying cause is insufficient authorization boundary enforcement between the locked-device state and features that surface user data. Keyboard suggestion providers did not consistently gate content on the device unlock state.
Attack Vector
An attacker requires physical possession of the target device. By interacting with interfaces that invoke the keyboard while the device is locked, such as replying to a notification, the attacker can prompt the suggestion strip to display cached input. No credentials, exploit code, or network access are required.
Refer to the Apple Support Article 125632 for Apple's technical description of the fix.
Detection Methods for CVE-2025-43452
Indicators of Compromise
- No file-based or network indicators exist for this vulnerability because exploitation is entirely physical and leaves no digital forensic artifacts.
- Unexpected physical access to a lost or unattended device should be treated as a potential exposure event.
Detection Strategies
- Inventory managed iOS and iPadOS devices through Mobile Device Management (MDM) to identify endpoints running versions prior to 26.1.
- Use MDM compliance policies to flag or restrict devices that have not received the iOS 26.1 or iPadOS 26.1 update.
- Correlate lost-device reports with account activity to identify potential exposure of credentials or one-time passcodes.
Monitoring Recommendations
- Monitor MDM dashboards for OS version drift and unpatched fleet devices.
- Track authentication anomalies on services whose credentials may have been typed on affected devices, particularly after physical loss events.
- Review conditional access logs for sign-ins from locations inconsistent with the device owner's activity.
How to Mitigate CVE-2025-43452
Immediate Actions Required
- Update all iPhone and iPad devices to iOS 26.1 or iPadOS 26.1.
- Enforce the update through MDM configuration profiles for corporate-managed devices.
- For lost or stolen devices running vulnerable versions, initiate remote wipe and rotate credentials that may have been recently entered.
Patch Information
Apple released the fix in iOS 26.1 and iPadOS 26.1. Details are available in the Apple Support Article 125632. The vendor addressed the issue by restricting the options offered on a locked device.
Workarounds
- Disable notification previews on the lock screen by navigating to Settings > Notifications > Show Previews > When Unlocked.
- Disable reply-from-lock-screen actions where possible to reduce the surface where the keyboard is invoked pre-authentication.
- Turn off keyboard predictive text in Settings > General > Keyboard > Predictive as an interim measure until the update is applied.
- Enforce strong device passcodes and Face ID or Touch ID to reduce the window of physical exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.