Loading vulnerability…
Zero-click remote code execution in Apple Messages via iCloud Link media
CVE-2025-43200 is a logic flaw in Apple Messages involving the processing of maliciously crafted photos or videos shared through an iCloud Link. Remote attackers can exploit the flaw through iMessage without requiring the recipient to open or view the media, potentially achieving remote code execution and device compromise. The vulnerability affects iOS, iPadOS, macOS, watchOS, and visionOS. It was exploited in targeted attacks against European journalists to deploy Paragon's Graphite spyware, including attacks on iPhones running iOS 18.2.1. Apple addressed the flaw with improved checks.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can enable remote code execution and full control of an affected device without user interaction. Observed attacks deployed Graphite spyware on journalists' iPhones. Graphite can access messages, emails, cameras, microphones, and location data, enabling extensive surveillance. Apple acknowledged a report of possible exploitation in extremely sophisticated attacks against specific targeted individuals; forensic investigations subsequently linked targeted iPhone attacks to this vulnerability.
If you can’t patch tonight, do this now.
High-risk users can consider enabling Lockdown Mode to reduce the attack surface, although its effectiveness against this specific vulnerability is not established. Avoiding unsolicited iCloud Links is not a sufficient safeguard because exploitation does not require opening or viewing the malicious media. Users who suspect spyware compromise should seek specialist forensic assistance.
Patch, then assume compromise.
Install the applicable fixed release or a later supported version: iOS and iPadOS 15.8.4, iOS and iPadOS 16.7.11, iOS and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, or watchOS 11.3.1. The fixes introduce improved checks during media processing.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.