What is the CVSS score of CVE-2025-43270?

CVE-2025-43270 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2025-43270?

CVE-2025-43270 is a macOS sandbox escape affecting Ventura, Sonoma, and Sequoia that allows locally installed applications to bypass network access restrictions, potentially enabling unauthorized…

How to fix or mitigate CVE-2025-43270?

24 hours: Inventory macOS devices running Ventura <13.7.7, Sonoma <14.7.8, or Sequoia <15.6; communicate advisory to Mac users against installing unvetted third-party applications. 7 days: Prioritize patching to macOS Ventura 13.7.7, Sonoma 14.7.8, or Sequoia 15.6 or later; enforce application vetting policies for user-installed software. 30 days: Complete patching across all affected macOS endpoints; review endpoint detection capabilities for network-based behavioral anomalies from sandbox escape attempts.

macOS CVE-2025-43270

HIGH

Improper Access Control (CWE-284)

2025-07-30 product-security@apple.com

Apple macOS Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

HIGH 8.8

DescriptionCVE.org

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may gain unauthorized access to Local Network.

AnalysisAI

macOS sandbox escape vulnerability allows locally installed applications to bypass Local Network access restrictions and perform unauthorized network operations. Affects macOS Ventura (pre-13.7.7), Sonoma (pre-14.7.7), and Sequoia (pre-15.6). CVSS 8.8 reflects high impact on confidentiality, integrity, and availability with scope change, but requires local access with low privileges (PR:L). EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability. No public exploit identified at time of analysis, and not listed in CISA KEV. Real-world risk centers on malicious apps installed by legitimate users bypassing Apple's network privacy controls.

Technical ContextAI

This vulnerability affects Apple's App Sandbox security framework, specifically the subsystem controlling Local Network access permissions in macOS. The App Sandbox uses entitlements and security profiles to restrict application capabilities, including network access. CWE-284 (Improper Access Control) indicates the sandbox enforcement mechanism failed to properly validate or restrict Local Network privileges. The Local Network permission in macOS (introduced in macOS 11 Big Sur) requires explicit user consent for apps to discover and communicate with devices on the same local network. This vulnerability represents a sandbox escape where insufficient restrictions allowed apps to bypass these privacy controls and gain unauthorized network access without user approval. The affected CPE strings span three major macOS release trains: Ventura (13.x), Sonoma (14.x), and Sequoia (15.x), indicating a long-standing architectural issue in the sandbox implementation rather than a recent regression.

RemediationAI

Apply vendor-released patches immediately: upgrade macOS Ventura to version 13.7.7 or later, macOS Sonoma to version 14.7.7 or later, or macOS Sequoia to version 15.6 or later. These updates include enhanced sandbox restrictions that properly enforce Local Network access controls. Updates can be installed through System Settings > General > Software Update or via Apple Software Update for managed deployments. For enterprise environments, test patches in a controlled environment before broad deployment, but prioritize rollout given the sandbox escape nature. No effective workarounds exist as the vulnerability resides in the core sandbox enforcement mechanism. Organizations should also review installed applications and remove unnecessary or untrusted software to reduce attack surface. Detailed security content information is available in Apple's official security advisories at support.apple.com/en-us/124149, support.apple.com/en-us/124150, and support.apple.com/en-us/124151. Additional technical discussion may be found in Full Disclosure mailing list archives (seclists.org/fulldisclosure/2025/Jul/32-34).