Description
An injection issue was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. Processing an email may lead to user interface spoofing.
Published: 2025-05-12
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: User Interface Spoofing
Action: Update OS
AI Analysis

Impact

An input validation weakness in the mail processing subsystem was corrected in the latest releases. The flaw allows crafted email content to inject UI elements that cause the operating system to display a spoofed interface, potentially deceiving users about the origin of notifications or messages. This injection is a classic instance of web-based UI manipulation, identified as CWE-79.

Affected Systems

All devices running versions of Apple iOS prior to 18.5 and iPadOS prior to 18.5 (iPadOS 17.7.7 also receiving the fix). These include iPhone and iPad models that support the affected operating system releases.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of less than 1% shows that exploitation is expected to be very uncommon, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft an email that a user opens, making the vector indirect and dependent on social or phishing tactics. If successful, the attacker can manipulate the device’s user interface to mislead the user without achieving code execution.

Generated by OpenCVE AI on April 28, 2026 at 11:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade every device to iOS 18.5 or later, or to iPadOS 18.5 or iPadOS 17.7.7 where available.
  • Use a reliable email filtering solution to detect and block suspicious HTML content, and avoid opening links from unknown senders.
  • Adjust mail settings to reduce or disable HTML content rendering, such as blocking external images or disabling rich HTML mail.

Generated by OpenCVE AI on April 28, 2026 at 11:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-14859 An injection issue was addressed with improved input validation. This issue is fixed in iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5. Processing an email may lead to user interface spoofing.
History

Tue, 28 Apr 2026 11:45:00 +0000

Type Values Removed Values Added
Title Injection in Email Handling Allows User Interface Spoofing on iOS/iPadOS

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description An injection issue was addressed with improved input validation. This issue is fixed in iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5. Processing an email may lead to user interface spoofing. An injection issue was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. Processing an email may lead to user interface spoofing.

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Tue, 27 May 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple ipados
Apple iphone Os

Wed, 14 May 2025 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 May 2025 21:45:00 +0000

Type Values Removed Values Added
Description An injection issue was addressed with improved input validation. This issue is fixed in iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5. Processing an email may lead to user interface spoofing.
References

Subscriptions

Apple Ipados Iphone Os
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:20:31.472Z

Reserved: 2025-01-17T00:00:45.004Z

Link: CVE-2025-24225

cve-icon Vulnrichment

Updated: 2025-11-03T19:44:23.461Z

cve-icon NVD

Status : Modified

Published: 2025-05-12T22:15:20.260

Modified: 2026-04-02T19:19:22.237

Link: CVE-2025-24225

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T11:30:29Z

Weaknesses