CVE-2025-43459

An authentication issue was addressed with improved state management. This issue is fixed in watchOS 26.1. An attacker with physical access to a locked Apple Watch may be able to view Live Voicemail.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/125639	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se abordó un problema de autenticación con una gestión de estado mejorada. Este problema está solucionado en watchOS 26.1. Un atacante con acceso físico a un Apple Watch bloqueado podría ver el Buzón de Voz en Vivo.

Information

Published : 2025-11-04 02:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-43459

Mitre link : CVE-2025-43459

CVE.ORG link : CVE-2025-43459

JSON object : View

Products Affected

apple

watchos

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-43459", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43459", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T13:20:58.294595Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "watchOS", "versions": [{"status": "affected", "version": "0", "lessThan": "26.1", "versionType": "custom"}]}]}], "published": "2025-11-04T02:15:51.313", "references": [{"url": "https://support.apple.com/en-us/125639", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in watchOS 26.1. An attacker with physical access to a locked Apple Watch may be able to view Live Voicemail."}, {"lang": "es", "value": "Se abord\u00f3 un problema de autenticaci\u00f3n con una gesti\u00f3n de estado mejorada. Este problema est\u00e1 solucionado en watchOS 26.1. Un atacante con acceso f\u00edsico a un Apple Watch bloqueado podr\u00eda ver el Buz\u00f3n de Voz en Vivo."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F9D7F76-13FB-407C-94E5-221B93021568", "versionEndExcluding": "26.1"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}