CVE-2025-43496
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Nov 4, 2025
CISA due date
—
The record
The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Biometric… CWE-359
- CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could… CWE-359
- CVE-2026-74966 Information disclosure in the Form Autofill component. CWE-359
- CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… CWE-359
- CVE-2026-55496 Cloudreve is a self-hosted file management and sharing system. CWE-359
- CVE-2026-58297 Exposure of private personal information to an unauthorized actor in Microsoft Edge for… CWE-359
- CVE-2026-58296 Exposure of private personal information to an unauthorized actor in Microsoft Edge for… CWE-359
- CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in… CWE-359