CVE-2025-43350 is a permissions-related vulnerability discovered in Apple’s iOS and iPadOS platforms that allows unauthorized viewing of restricted content from the lock screen. The root cause is insufficient enforcement of permission restrictions on what content can be displayed when the device is locked, potentially enabling an attacker with physical access to the device to bypass lock screen protections and view sensitive notifications or data snippets. This vulnerability affects all versions prior to iOS and iPadOS 26.1, where Apple introduced additional restrictions to address the issue. The vulnerability does not require the attacker to unlock the device or authenticate, which significantly lowers the barrier to exploitation. Although no exploits have been reported in the wild, the potential for data leakage is significant, especially in environments where sensitive notifications or confidential information are displayed on the lock screen. The vulnerability primarily impacts confidentiality, as unauthorized users can access restricted content without permission. The lack of a CVSS score suggests the vulnerability was recently published and not yet fully assessed, but the nature of the flaw indicates a high risk of sensitive data exposure. The vulnerability is particularly relevant for organizations and individuals relying on Apple mobile devices for secure communications and data handling. The fix is included in iOS and iPadOS 26.1, emphasizing the importance of timely patching. Organizations should also review lock screen notification settings to minimize sensitive content exposure.

For European organizations, this vulnerability poses a significant risk to data confidentiality, especially in sectors handling sensitive or regulated information such as finance, healthcare, and government. If devices are lost, stolen, or accessed by unauthorized personnel, attackers could view confidential notifications or data previews without needing to bypass device authentication. This could lead to data breaches, regulatory non-compliance (e.g., GDPR violations), reputational damage, and potential financial losses. The impact is amplified in environments where mobile devices are widely used for business communications and where lock screen notifications include sensitive content. Additionally, organizations with bring-your-own-device (BYOD) policies may face increased exposure if employees do not update their devices promptly. The vulnerability does not directly affect device integrity or availability but compromises the confidentiality of information displayed on the lock screen.

1. Immediately update all Apple iOS and iPadOS devices to version 26.1 or later to apply the official fix from Apple. 2. Review and configure lock screen notification settings to limit or disable the display of sensitive content on the lock screen, such as message previews, email snippets, or calendar details. 3. Enforce mobile device management (MDM) policies that mandate timely OS updates and restrict lock screen content exposure. 4. Educate users on the risks of leaving devices unattended and the importance of physical security. 5. Implement strong device passcodes and biometric authentication to reduce unauthorized physical access. 6. Consider disabling lock screen widgets or features that may expose sensitive data until devices are patched. 7. Monitor for any emerging exploits or indicators of compromise related to this vulnerability and respond accordingly.