Apple CVE-2025-43200: iCloud Link Zero-Click, Graphite

What to do

1. Pull an OS version report from your MDM and list every iPhone, iPad, Mac, Watch and Vision Pro below the fixed builds.
2. Update or retire those devices; devices that cannot reach a fixed build should not hold work accounts.
3. Enforce a minimum OS version in MDM or conditional access so unpatched devices cannot sync mail or chat.
4. Tell high-risk staff to treat an Apple threat notification as real, enable Lockdown Mode and get expert forensic help.
5. Check DNS and proxy logs for the Graphite server Citizen Lab published, 46.183.184[.]91.

How to check if you are affected or compromised

• Ask whether any user received an Apple threat notification, especially around April 29, 2025, when Apple sent the ones Citizen Lab investigated.
• Search DNS, proxy and firewall logs from late 2024 to April 2025 for connections to 46.183.184[.]91.
• For a suspected target, take an encrypted iTunes or Finder backup and have it reviewed by a specialist lab, for example with Amnesty's Mobile Verification Toolkit (mvt-ios).

What happened#

On February 10, 2025, Apple shipped iOS and iPadOS 18.3.1. At the time, the release notes listed one exploited bug, the USB Restricted Mode bypass CVE-2025-24200. Four months later Apple added a second entry, marked "Entry added June 11, 2025." It describes a logic issue in Messages "when processing a maliciously crafted photo or video shared via an iCloud Link," and credits Apple itself. The CVE record adds that Apple is aware of a report that it may have been exploited in "an extremely sophisticated attack against specific targeted individuals."

The reason became public on June 12, 2025. Citizen Lab published the first forensic confirmation of Paragon's Graphite spyware on iPhones. A prominent European journalist was infected in January and early February 2025 while running iOS 18.2.1. Italian journalist Ciro Pellegrino of Fanpage.it was also targeted. Both had received Apple threat notifications on April 29, 2025. The European journalist's phone was hit by a zero-click iMessage attack from an account Citizen Lab calls ATTACKER1, and the same account turned up on Pellegrino's phone. It says Apple assigned CVE-2025-43200 to the zero-day and that the attack "was mitigated as of iOS 18.3.1." The infected phone talked to 46.183.184[.]91, a server matching Citizen Lab's Graphite fingerprint. The authors believe one Paragon customer targeted both men.

The CVE record was published on June 16, 2025. CISA added the bug to the KEV catalog the same day, with a July 7 deadline.

Who is affected#

Per the CVE record, iOS and iPadOS before 18.3.1, 16.7.11 and 15.8.4; iPadOS 17 before 17.7.5; macOS Sequoia before 15.3.1, Sonoma before 14.7.4 and Ventura before 13.7.4; watchOS before 11.3.1; and visionOS before 2.3.1. CISA's enrichment, shown on NVD, scores it only CVSS 3.1 4.2.

Do you really need to act?#

For most organizations, no new work is needed. The fix is more than eighteen months old, and every later Apple release includes it. The attack was aimed at a handful of journalists and activists, not at the general public. The real exposure is the long tail: old iPads on iPadOS 17 or earlier, phones stuck on iOS 15 or 16, and Macs on old builds.

The second audience is anyone who protects high-risk people. Citizen Lab's main lesson is that Apple's threat notifications were accurate. This also sits in a busy year for iPhone zero-days. The same 18.3.1 release fixed CVE-2025-24200, and CISA added more exploited Apple bugs later in 2025, including CVE-2025-31200, CVE-2025-31201 and CVE-2025-43300. "Patched for this CVE" only matters if the device is on a current release.

What to do now#

1. Export OS versions from your MDM and flag every device below the fixed builds listed above.
2. Update those devices, or retire any that cannot reach a fixed build.
3. Set a minimum OS version in MDM or conditional access so outdated devices cannot reach work mail or chat.
4. Brief high-risk staff: treat an Apple threat notification as real, turn on Lockdown Mode and contact a specialist helpline.

How to tell if you were hit#

Ask whether anyone received an Apple threat notification, especially in spring 2025. Search DNS, proxy and firewall logs from late 2024 to April 2025 for 46.183.184[.]91. Citizen Lab saw it match the Graphite fingerprint until at least April 12, 2025. For a suspected target, make an encrypted backup and have a specialist lab examine it, for example with mvt-ios check-backup. Do not wipe the phone first.

Timeline#

• Jan 2025 — The European journalist's iPhone, on iOS 18.2.1, is infected with Graphite (exact dates redacted).
• Feb 10, 2025 — Apple releases iOS 18.3.1, which mitigates the attack.
• Apr 29, 2025 — Apple sends threat notifications to the two journalists.
• Jun 11, 2025 — Apple adds CVE-2025-43200 to the iOS 18.3.1 notes.
• Jun 12, 2025 — Citizen Lab publishes its Graphite report.
• Jun 16, 2025 — CVE published; CISA adds it to KEV.
• Jul 7, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2025-43200 · KEV 2025-06-16 · This issue was addressed with improved checks.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Apple — About the security content of iOS 18.3.1 and iPadOS 18.3.1 support.apple.com
2. Citizen Lab — Graphite Caught: First Forensic Confirmation of Paragon's iOS Mercenary Spyware Finds Journalists Targeted citizenlab.ca
3. CVE record — CVE-2025-43200 cve.org
4. NVD — CVE-2025-43200 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2025-43200 cisa.gov