CVE-2025-43428: 
macOS vulnerability analysis and mitigation

CVE-2025-43428 is a missing authentication vulnerability in Apple's Photos app that allows photos stored in the Hidden Photos Album to be viewed without authentication. It affects iOS and iPadOS (before 26.2), macOS Tahoe (before 26.2), and visionOS (before 26.2). The vulnerability was disclosed on December 12, 2025, when Apple released the patched versions, and was formally published to NVD on December 17, 2025. It carries a CVSS v3.1 base score of 9.8 (Critical), as assessed by CISA-ADP (Apple Advisory iOS/iPadOS, Apple Advisory macOS, Apple Advisory visionOS).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function) — specifically, a configuration issue in the Photos component that failed to enforce authentication before granting access to the Hidden Photos Album. Apple addressed the flaw by applying additional restrictions to the relevant configuration. The vulnerability was discovered independently by an anonymous researcher and Michael Schmutzer of Technische Hochschule Ingolstadt. No public proof-of-concept or detailed technical write-up describing the precise exploitation mechanics has been published as of the time of this report (Apple Advisory iOS/iPadOS, Apple Advisory macOS).

Successful exploitation allows an attacker to view photos that a user has intentionally hidden in the Hidden Photos Album without providing any authentication (e.g., Face ID, Touch ID, or passcode), directly compromising user privacy and confidentiality. The CVSS vector assigned by CISA-ADP rates confidentiality, integrity, and availability impacts all as HIGH with no privileges or user interaction required, though the practical impact is primarily a confidentiality breach — unauthorized access to sensitive personal images. The vulnerability affects a broad range of Apple devices across iOS, iPadOS, macOS Tahoe, and visionOS platforms (Apple Advisory iOS/iPadOS, Apple Advisory visionOS).

Apple has released patches addressing this vulnerability in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, and visionOS 26.2, all released on December 12, 2025. Users should update their devices to these versions or later immediately via Settings > General > Software Update (iOS/iPadOS/visionOS) or System Settings > General > Software Update (macOS). Enabling automatic updates is recommended to ensure timely application of future security patches. No configuration-based workaround is available short of upgrading (Apple Advisory iOS/iPadOS, Apple Advisory macOS, Apple Advisory visionOS).

The vulnerability was covered by technology media outlets including 9to5Mac, Lifehacker, and Macworld in the context of the broader iOS 26.2 security update release. The CIS Security advisory noted multiple vulnerabilities in Apple products patched in this release cycle. Community discussion was moderate, with some outlets urging users to update promptly due to the high CVSS score, though security researchers noted the practical exploitability is more limited than the score suggests (9to5Mac, CIS Advisory).