Apple watchOS up to 18.2 information disclosure

Summaryinfo

A vulnerability has been found in Apple watchOS and classified as problematic. The affected element is an unknown function. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2025-43190. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apple watchOS. It has been declared as problematic. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sonoma 14.8, macOS Sequoia 15.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. An app may be able to access sensitive user data.

It is possible to read the advisory at support.apple.com. This vulnerability is known as CVE-2025-43190 since 04/16/2025. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 265371 (macOS 26.x < 26.0 Multiple Vulnerabilities (125110)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 26.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (265371). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Smartwatch Operating System

Vendor

• Apple

Name

• watchOS

Version

• 2.2.2
• 3
• 3.1
• 3.1.1
• 3.1.3
• 3.2
• 3.2.2
• 3.2.3
• 4.0
• 4.2
• 4.2.2
• 4.2.3
• 4.3
• 4.3.1
• 4.3.2
• 4.4.2
• 5.0
• 5.1
• 5.1.3
• 5.2
• 5.2.1
• 5.3
• 5.3.2
• 5.3.7
• 5.3.9
• 6.0
• 6.1
• 6.1.2
• 6.2
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.8
• 6.2.9
• 7.0
• 7.0.3
• 7.1
• 7.2
• 7.3
• 7.3.2
• 7.3.3
• 7.4
• 7.4.1
• 7.5
• 7.6
• 7.6.2
• 8.0
• 8.1
• 8.3
• 8.4
• 8.5
• 8.6
• 8.7
• 8.8.1
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.5.1
• 9.5.2
• 9.6
• 10.0
• 10.5
• 10.15.0
• 10.15.1
• 12.1
• 13.0
• 13.7
• 14.0
• 15
• 15.1
• 18
• 18.1
• 18.2

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion