What is the CVSS score of CVE-2025-43243?

CVE-2025-43243 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of macOS are affected by CVE-2025-43243?

CVE-2025-43243 is a critical file system permission bypass in macOS that allows locally executed applications to modify protected system files without authorization, affecting Sequoia, Sonoma, and…

How to fix or mitigate CVE-2025-43243?

Within 24 hours: Inventory all macOS Sequoia (pre-15.6), Sonoma (pre-14.7.7), and Ventura (pre-13.7.7) endpoints; disable or remove untrusted third-party applications pending patch availability. Within 7 days: Monitor Apple security advisories for vendor-released patches targeting this CVE; establish a staged testing plan for critical business units. Within 30 days: Deploy patches to all affected macOS versions immediately upon vendor release; verify patches via Apple's official security updates and validate application compatibility before full production rollout.

macOS CVE-2025-43243

CRITICAL

Incorrect Permission Assignment for Critical Resource (CWE-732)

2025-07-30 product-security@apple.com

Apple macOS Privilege Escalation

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

CRITICAL 9.8

DescriptionCVE.org

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to modify protected parts of the file system.

AnalysisAI

File system permission bypass in macOS allows applications to modify protected system files without proper authorization. Affects macOS Sequoia (prior to 15.6), Sonoma (prior to 14.7.7), and Ventura (prior to 13.7.7). Despite a critical 9.8 CVSS score with network attack vector rating, the vulnerability requires local application execution, making the CVSS vector potentially misleading. EPSS exploitation probability is very low at 0.08% (24th percentile), and no public exploit identified at time of analysis. Tagged for information disclosure, though integrity impact is primary concern given file system modification capability.

Technical ContextAI

This vulnerability stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), specifically affecting macOS permission enforcement mechanisms that protect system-critical file system locations. The affected products span three major macOS versions: Sequoia 15.x, Sonoma 14.x, and Ventura 13.x according to CPE data. The issue involves insufficient restrictions on application-level file system operations, allowing apps to bypass intended protections on directories and files that should be restricted to system processes or privileged operations. Apple's permission model relies on sandboxing, entitlements, and System Integrity Protection (SIP) to prevent unauthorized file system modifications. This vulnerability represents a breakdown in one or more of these defensive layers, potentially allowing malicious or compromised applications to write to protected locations such as system frameworks, LaunchDaemons, or kernel extensions directories.

RemediationAI

Vendor-released patches are available: upgrade to macOS Sequoia 15.6, macOS Sonoma 14.7.7, or macOS Ventura 13.7.7 depending on current major version. Apple addressed the permissions issue through additional restrictions in the file system access control mechanisms. Users should apply updates through System Settings > General > Software Update or via Apple's enterprise deployment tools for managed environments. No workarounds are documented in the vendor advisories. Full remediation details and download links are available in Apple's security advisories at https://support.apple.com/en-us/124149 (Sequoia), https://support.apple.com/en-us/124150 (Sonoma), and https://support.apple.com/en-us/124151 (Ventura). Organizations should prioritize patching for systems where untrusted applications may be installed or where users have local admin rights that could facilitate exploitation.