Apple macOS
CVE-2025-43388
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious app to macOS host
-
ExploitApp executes with user privileges
-
ExecutionAbuse injection/improper validation flaw
-
ImpactAccess sensitive user data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a malicious application to already be present and executing on the macOS host with normal low-level user privileges (CVSS PR:L, AV:L) - there is no remote or network-reachable vector and no victim user interaction is needed once the app runs. The practical limiting factor is that an attacker must first get code (an app) running locally on the target Mac; success then yields read access to sensitive user data only (C:H, I:N, A:N). No non-default configuration is called out in Apple's advisory, so default macOS installations prior to Tahoe 26.1 appear affected. |
| Impact | This is a moderate-risk, local-only information disclosure flaw rather than an urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable issue requiring an already-running low-privilege app, with high confidentiality impact but no integrity or availability impact - consistent with the description 'an app may be able to access sensitive user data.' All exploitation signals point the same direction and reinforce low urgency: EPSS is 0.21% (11th percentile, i.e. low predicted exploitation), the CVE is NOT on CISA KEV, and no public exploit code is referenced. No SSVC decision data was provided in the input. The one tension worth noting is the 'Code Injection' tag plus CWE-95 (eval/code injection), which sounds severe, yet the CVSS vector sets I:N and A:N - meaning Apple scoped the real-world effect to reading sensitive data, not arbitrary code execution or system compromise. Net: a genuine but contained local privacy/sandbox-escape-style issue, appropriate to patch via normal macOS update cycles rather than emergency response. |
| Exploit ScenarioDerived | A user installs or is tricked into running a malicious or trojanized macOS application. Because the flaw is local and requires only low privileges (a normal user-level app, no further interaction), the app abuses the injection weakness to validate improperly and read sensitive user data it should not be able to reach. No public proof-of-concept or exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Local information disclosure in Apple macOS allows a malicious application that is already running on the Mac to read sensitive user data that it should not be able to reach, with the underlying flaw classified as an injection issue (CWE-95) fixed in macOS Tahoe 26.1. Exploitation requires the attacker to first get an app executing on the host with ordinary local user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and success yields confidentiality impact only - no modification of data and no denial of service. There is no remote or network vector and no victim interaction beyond running the malicious app, and at time of analysis there is no public exploit identified and no evidence of active exploitation; EPSS is 0.21% (11th percentile), consistent with a moderate-risk, local-only disclosure rather than an urgent, widely targeted issue. The vendor has released a patch, macOS Tahoe 26.1.
RemediationAI
Vendor-released patch: macOS Tahoe 26.1, which fixes this injection issue via improved validation - update through System Settings > General > Software Update (or an MDM software-update policy) and confirm the reported build afterward; details are in Apple's advisory at https://support.apple.com/en-us/125634. Because exploitation is local-only and requires a malicious app to already be executing with normal user privileges, the practical compensating controls all target the precondition rather than the disclosure path itself: keep Gatekeeper and notarization enforcement enabled so unsigned or unnotarized bundles cannot be launched casually, and maintain App Sandbox entitlements so a compromised app has less reachable data - the trade-off is that these controls will also block legitimate internally developed unsigned tooling, which then needs an explicit Developer ID or managed allowlisting exception. Apply least-privilege by removing standing admin rights and restricting which users can install or run applications, and keep XProtect and the built-in malware definitions current, accepting that signature-based detection may lag novel or targeted payloads. Restricting file permissions on high-value sensitive data (user documents, keychain access groups, browser profile directories) limits what a locally executing app can read after a successful injection, though this can break legitimate application and backup workflows and is only a containment measure, not a fix. Note that patch status is: patch available and version-confirmed as macOS Tahoe 26.1; no public exploit was identified at the time of analysis, so these controls should be treated as defense-in-depth alongside - not instead of - applying the update.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-95, Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'), meaning an input or app-supplied value was able to reach a dynamically evaluated or interpreted code context without adequate neutralization, letting the injected directive influence execution in a way that exposes data outside the app's intended access. Apple's advisory (support.apple.com/en-us/125634) describes this as an injection issue addressed with improved validation, which is the typical remediation pattern for eval-injection defects: rather than removing the evaluation mechanism, input is validated/neutralized before it reaches the interpreter. The CPE record cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* is fully wildcarded, indicating that the advisory is scoped to the macOS operating system generally and that all builds prior to the fixed release are treated as potentially affected; the advisory does not name the specific component, framework, or service containing the flaw, so the precise injection surface cannot be confirmed from available data. The CVSS vector places this firmly in the local-only class: AV:L and PR:L mean the offending code must already execute on the host under normal user privileges, UI:N means no additional user action is needed once that code runs, and C:H with I:N/A:N means the resulting capability is read access to sensitive user data rather than code execution, tampering, or crash.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
A locally-running low-privilege app is required (AV:L, PR:L, no user interaction), and the impact is limited to reading sensitive data, so C:H with I:N/A:N.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
An injection issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
GitHub PoC
Exploit-DB