Exploitation observed; activity peaked at 6 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-07-07. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
HIGH
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-27 | 3 | Active Exploitation2False Positive1 |
| 2026-01-28 | 1 | General1 |
| 2026-02-12 | 6 | Active Exploitation2Exploit1General1Patch2 |
| 2026-03-16 | 1 | General1 |
@emad_nesr @alghali @IntCyberDigest أداة Graphite من Paragon تستغل ثغرات zero-click، مثل CVE-2025-43200 في iMessage للاختراق دون تفاعل المستخدم، وCVE-2025-27363 في مكتبة FreeType لتنفيذ كود عشوائي على أجهزة iOS. تم استهداف صحفيين أوروبيين، وأصلحت آبل الثغرات في تحديثاتها.
Post summary
Graphite from Paragon exploits zero-click CVE‑2025‑43200 (iMessage) and CVE‑2025‑27363 (FreeType) on iOS, targeting journalists, with Apple issuing patches.
@emad_nesr @alghali @IntCyberDigest وفقًا لتقارير أبل، تم سد ثغرة CVE-2025-43200 في تحديثات مثل iOS 15.8.4 وmacOS Ventura 13.7.4. أما الاختراق عبر مكالمة أو رسالة دون تفاعل، فهو ممكن سابقًا، لكن التحديثات تحمي منه. نصيحة: حدث جهازك دائمًا.
Post summary
Apple has patched CVE-2025-43200 in iOS 15.8.4 and macOS Ventura 13.7.4, mitigating the previously possible call/message exploitation.
@emad_nesr @alghali @IntCyberDigest الأكواد المصدرية لأداة Graphite غير متاحة علنًا، إذ هي ملكية خاصة بشركة Paragon. الثغرات المعروفة تشمل CVE-2025-43200 (في iMessage للاختراق بدون تفاعل) وCVE-2025-27363 (في مكتبة FreeType لتنفيذ كود عشوائي). التسريب الأخير كان لواجهة التحكم عبر LinkedIn فقط.
Post summary
The post enumerates two CVEs with brief impact descriptions and notes the Graphite tool’s source code remains proprietary, but offers no proof of exploitation, exploit code, patch, or debunking.
Paragon's Graphite often uses zero-click exploits via iMessage. An attacker sends invisible data packets exploiting vulnerabilities (e.g., CVE-2025-43200 in iOS 18.2.1) to the target's device. This installs the spyware silently in the background, without any notification or action needed. It then connects to a control server for remote access. Methods can evolve; keeping devices updated helps mitigate risks.
Post summary
The post reports that Paragon's Graphite uses zero‑click iMessage exploits targeting CVE‑2025‑43200 on iOS 18.2.1, indicating active exploitation while noting that keeping devices updated mitigates the risk.
@imajdart @emad_nesr @alghali @IntCyberDigest نعم، iMessage مدمج في نظام iOS كجزء أساسي من تطبيق الرسائل (Messages)، ولا يُعتبر تطبيقًا إضافيًا خارجيًا. لكنه كان عرضة لثغرات zero-click مثل CVE-2025-43200، والتي سُدت في تحديثات أبل. حدث جهازك للحماية.
Post summary
The tweet notes that iMessage suffered a zero‑click vulnerability (CVE-2025-43200) but Apple has addressed it in updates, and users are advised to update their devices for protection.
@IntCyberDigest Softwear Graphit... install on Apple ios via Zero-Click-Attack > iOS 18.3.1 CVE-2025-43200...🙇♂️
Post summary
The tweet claims a zero‑click attack using CVE-2025-43200 has been employed to install malware on iOS 18.3.1, indicating active exploitation, but it offers no technical details or remediation guidance.
Top 5 Trending CVEs: 1 - CVE-2025-55177 2 - CVE-2025-43200 3 - CVE-2010-5139 4 - CVE-2026-24858 5 - CVE-2025-36911 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The tweet simply lists trending CVE identifiers with a link to a dashboard, providing no further technical or operational details.
No evidence confirms CVE-2025-43200 was an intentional backdoor for national security; it's described as a patched flaw in reports. Speculation exists due to historical US efforts for access, but it's unproven. ICE signed a $2M contract with Paragon for Graphite on Sep 27, 2024; first reported uses appear in early 2025 amid pauses and reviews.
Post summary
The post dismisses speculation that CVE-2025-43200 was an intentional backdoor, noting it is a patched flaw and lacks evidence of exploitation.
The article mentions Italian journalist Ciro Pellegrino as a victim targeted and infected with Paragon's Graphite spyware in Jan/Feb 2025 via a zero-click exploit in Apple's Messages app (CVE-2025-43200). He and another European journalist received Apple threat notifications on April 29, 2025. Forensic evidence, per Citizen Lab, includes iMessage logs from an "ATTACKER1" account that deployed the spyware without user action, enabling access to messages, emails, cameras, mics, and location data. Logs are stored on customer servers.
Post summary
The article reports that CVE‑2025‑43200 was actively exploited in the wild to deliver Paragon’s Graphite spyware to journalists via a zero‑click attack on Apple Messages, providing evidence through iMessage logs.
Upon reviewing the article, it does mention Graphite's capability to access cameras covertly: "It can access messages, emails, cameras, microphones, and location data without any user action." CVE-2025-43200 is the identifier for a zero-click flaw in Apple's Messages app, involving a logic issue with maliciously crafted photos/videos via iCloud Links, exploited to deploy Graphite spyware. Apple patched it in February 2025 updates.
Post summary
The article confirms that CVE-2025-43200, a zero-click flaw in Apple Messages, has been actively exploited to deploy Graphite spyware and has already been patched in February 2025 updates.
@maulanafikri455 Ah masa sih ? 🙄 Coba deh dicek : CVE-2025-43300 CVE-2025-43200 CVE-2023-41064 CVE-2023-41061 CVE-2021-30860
Post summary
The tweet simply lists several CVE identifiers without providing any further context, detail, or actionable information.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | apple | ipados | - | - | - |
| OS | apple | iphone_os | - | - | - |
| OS | apple | macos | - | - | - |
| OS | apple | visionos | - | - | - |
| OS | apple | watchos | - | - | - |