CVE-2025-43495: Apple iPadOS Keystroke Monitoring Vulnerability

CVE-2025-43495 Overview

CVE-2025-43495 is an information disclosure vulnerability in Apple iOS and iPadOS. An application can monitor keystrokes without receiving user permission, exposing potentially sensitive input such as credentials, messages, and search queries. Apple addressed the issue with improved checks in iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, and iPadOS 26.1. The weakness is classified as [CWE-200] Information Exposure. No public exploit code, proof-of-concept, or evidence of exploitation in the wild has been reported.

Critical Impact
A malicious or compromised app installed on an affected device can capture user keystrokes silently, bypassing the standard permission model.

Affected Products

Apple iOS versions prior to 18.7.2 and prior to 26.1
Apple iPadOS versions prior to 18.7.2 and prior to 26.1
iPhone and iPad devices running the impacted operating system builds

Discovery Timeline

2025-11-04 - CVE-2025-43495 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43495

Vulnerability Analysis

The vulnerability allows an installed application to monitor keystrokes without triggering iOS's permission prompts. iOS enforces user consent for input capture through entitlements and the TCC (Transparency, Consent, and Control) model. This flaw circumvented those checks, letting an app observe keyboard input outside of its own view context. Apple's advisory describes the fix as "improved checks," indicating a validation gap in the code path that governs input monitoring authorization.

The issue maps to [CWE-200], Exposure of Sensitive Information to an Unauthorized Actor. Because keystrokes may include passwords, one-time codes, messages, and personally identifiable information, unauthorized access breaks user confidentiality assumptions built into iOS.

Root Cause

The root cause is insufficient validation of an application's authorization before granting access to keystroke event streams. Apple has not published low-level technical details, and no third-party technical analysis is available in the referenced advisories.

Attack Vector

Exploitation requires a malicious application to be present on the device. The attacker uses that app to subscribe to or observe keyboard input events without prompting the user or holding the required entitlement. The scenario assumes the user has already installed the app, which limits scale but is realistic given App Store, TestFlight, enterprise, or sideloaded distribution channels.

No verified public proof-of-concept code is available for this issue. See Apple's advisories for the authoritative description: Apple Support Article 125632 and Apple Support Article 125633.

Detection Methods for CVE-2025-43495

Indicators of Compromise

No public indicators of compromise have been released for CVE-2025-43495.
Unexpected background activity, elevated battery drain, or persistent network egress from a recently installed app may warrant closer review.
Applications requesting unusual keyboard, accessibility, or input-related APIs on unpatched devices should be treated as suspicious.

Detection Strategies

Inventory managed iOS and iPadOS devices and identify builds older than 18.7.2 or 26.1 as at-risk.
Use Mobile Device Management (MDM) reporting to flag installed applications that are not part of an approved allowlist.
Review application privacy reports on iOS for unexpected sensor or input access patterns.

Monitoring Recommendations

Enforce MDM compliance policies that quarantine devices running vulnerable OS builds until patched.
Monitor egress traffic from mobile fleets for anomalous destinations that could indicate exfiltration of captured input.
Track new application installs and correlate them with user behavior signals in your identity and access telemetry.

How to Mitigate CVE-2025-43495

Immediate Actions Required

Update all iPhone and iPad devices to iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, or iPadOS 26.1 or later.
Push mandatory OS update policies through your MDM platform to enforce patch adoption.
Audit installed applications and remove any that are unnecessary, unknown, or not from trusted publishers.

Patch Information

Apple fixed the issue in iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, and iPadOS 26.1. Refer to Apple Support Article 125632 and Apple Support Article 125633 for the full advisory content and device compatibility.

Workarounds

No vendor-supplied workaround exists. Patching is the only supported remediation.
Restrict installation of non-enterprise applications through MDM configuration profiles until affected devices are updated.
Advise users to avoid entering high-value credentials on unpatched devices and to use hardware security keys or passkeys where available.

bash

# Example: query MDM inventory for devices below the patched build
# (Adapt to your MDM's query language or API)
mdm-cli devices list \
  --platform ios \
  --os-version-lt 18.7.2 \
  --fields serial,user,os_version,last_checkin