CVE-2025-43270
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2Description
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may gain unauthorized access to Local Network.
Analysis
macOS sandbox escape vulnerability allows locally installed applications to bypass Local Network access restrictions and perform unauthorized network operations. Affects macOS Ventura (pre-13.7.7), Sonoma (pre-14.7.7), and Sequoia (pre-15.6). CVSS 8.8 reflects high impact on confidentiality, integrity, and availability with scope change, but requires local access with low privileges (PR:L). EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability. No public exploit identified at time of analysis, and not listed in CISA KEV. Real-world risk centers on malicious apps installed by legitimate users bypassing Apple's network privacy controls.
Technical Context
This vulnerability affects Apple's App Sandbox security framework, specifically the subsystem controlling Local Network access permissions in macOS. The App Sandbox uses entitlements and security profiles to restrict application capabilities, including network access. CWE-284 (Improper Access Control) indicates the sandbox enforcement mechanism failed to properly validate or restrict Local Network privileges. The Local Network permission in macOS (introduced in macOS 11 Big Sur) requires explicit user consent for apps to discover and communicate with devices on the same local network. This vulnerability represents a sandbox escape where insufficient restrictions allowed apps to bypass these privacy controls and gain unauthorized network access without user approval. The affected CPE strings span three major macOS release trains: Ventura (13.x), Sonoma (14.x), and Sequoia (15.x), indicating a long-standing architectural issue in the sandbox implementation rather than a recent regression.
Affected Products
This vulnerability affects Apple macOS across three major release lines. Specifically impacted are macOS Ventura versions prior to 13.7.7, macOS Sonoma versions prior to 14.7.7, and macOS Sequoia versions prior to 15.6. All installations of these operating system versions contain the vulnerable sandbox implementation that fails to properly enforce Local Network access restrictions. Apple's product security team identified and reported this issue. Official vendor advisories are available at support.apple.com/en-us/124149 (Sequoia), support.apple.com/en-us/124150 (Sonoma), and support.apple.com/en-us/124151 (Ventura).
Remediation
Apply vendor-released patches immediately: upgrade macOS Ventura to version 13.7.7 or later, macOS Sonoma to version 14.7.7 or later, or macOS Sequoia to version 15.6 or later. These updates include enhanced sandbox restrictions that properly enforce Local Network access controls. Updates can be installed through System Settings > General > Software Update or via Apple Software Update for managed deployments. For enterprise environments, test patches in a controlled environment before broad deployment, but prioritize rollout given the sandbox escape nature. No effective workarounds exist as the vulnerability resides in the core sandbox enforcement mechanism. Organizations should also review installed applications and remove unnecessary or untrusted software to reduce attack surface. Detailed security content information is available in Apple's official security advisories at support.apple.com/en-us/124149, support.apple.com/en-us/124150, and support.apple.com/en-us/124151. Additional technical discussion may be found in Full Disclosure mailing list archives (seclists.org/fulldisclosure/2025/Jul/32-34).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today