CVE-2025-43537 Overview
CVE-2025-43537 is a path handling vulnerability affecting Apple iOS and iPadOS. The flaw resides in the backup restoration logic, where insufficient validation allows a maliciously crafted backup file to modify protected system files during restore. Apple addressed the issue with improved path validation in iOS 18.7.5, iPadOS 18.7.5, iOS 26.2, and iPadOS 26.2. The vulnerability maps to [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). Exploitation requires local access and user interaction to initiate the restore operation, limiting opportunistic exploitation but enabling targeted attacks against device integrity.
Critical Impact
Restoring a maliciously crafted backup file can modify protected system files, undermining platform integrity guarantees on affected iOS and iPadOS devices.
Affected Products
- Apple iOS versions prior to 18.7.5 and prior to 26.2
- Apple iPadOS versions prior to 18.7.5 and prior to 26.2
- Devices restoring backup files from untrusted sources
Discovery Timeline
- 2026-02-11 - CVE-2025-43537 published to NVD
- 2026-04-02 - Last updated in NVD database
Technical Details for CVE-2025-43537
Vulnerability Analysis
The vulnerability stems from improper path validation in the iOS and iPadOS backup restore process. When the operating system processes a backup archive, it reconstructs file paths from metadata contained within the archive. Insufficient sanitization of these paths allows an attacker-controlled backup to direct writes outside the intended restoration sandbox. The result is modification of protected system files that the platform's integrity model is designed to safeguard.
The issue is classified under [CWE-22] path traversal. Apple's advisory notes the fix consists of improved validation, indicating the patched code now enforces stricter checks on destination paths before writing files during restore.
Root Cause
The root cause is missing or inadequate canonicalization of file paths embedded in backup archives. Path traversal sequences or absolute path references in the backup metadata were not normalized against an allow-listed root directory. This permitted the restore process, which runs with elevated privileges, to write files into protected locations that should be immutable for unprivileged inputs.
Attack Vector
The attack requires local access and user interaction. An attacker prepares a malicious backup file containing crafted path metadata, then convinces the user to restore the device from that backup. Because restore operations execute with privileges sufficient to write system locations, successful exploitation results in modification of protected system files. The vector is local because the malicious backup must be presented to the device through a restore workflow, not delivered remotely.
No public proof-of-concept code is available for this issue. Readers seeking technical specifics should consult the Apple Security Advisory #126347 and Apple Security Advisory #125884.
Detection Methods for CVE-2025-43537
Indicators of Compromise
- Unexpected modifications to protected system files following a backup restore operation
- Restore events sourced from backup archives delivered through untrusted channels or shared storage
- Devices running iOS or iPadOS versions below 18.7.5 or 26.2 that have recently performed a restore
Detection Strategies
- Audit mobile device management (MDM) logs for restore events on managed iOS and iPadOS endpoints
- Track iOS and iPadOS version inventory and flag devices below the patched releases
- Correlate backup file provenance with restore activity to identify archives from untrusted sources
Monitoring Recommendations
- Enable MDM compliance policies that report OS version and patch level for every enrolled device
- Alert on devices that fall out of compliance after a restore operation completes
- Review enterprise backup workflows to confirm backups originate only from trusted, attested sources
How to Mitigate CVE-2025-43537
Immediate Actions Required
- Update affected devices to iOS 18.7.5, iPadOS 18.7.5, iOS 26.2, or iPadOS 26.2 without delay
- Restrict restoration of device backups to archives originating from trusted, verified sources
- Communicate to users that backup files from unknown origins must not be used for device restoration
Patch Information
Apple released fixes in iOS 18.7.5, iPadOS 18.7.5, iOS 26.2, and iPadOS 26.2. Refer to the Apple Security Advisory #126347 and Apple Security Advisory #125884 for version-specific details and the complete list of addressed issues.
Workarounds
- Avoid restoring iOS or iPadOS devices from backup files received from untrusted parties or shared repositories
- Use MDM policies to enforce minimum OS versions and block enrollment of devices below the patched releases
- Maintain backups only in controlled, access-restricted storage that prevents tampering by unauthorized users
# Verify the installed iOS or iPadOS version on a managed device
# Replace with your MDM query or use Settings > General > About on the device
softwareupdate --list-installed-versions # macOS host inspecting connected device via configurator workflows
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
