macOS CVE-2025-43410
LOWCVSS VectorNVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.2. An attacker with physical access may be able to view deleted notes.
AnalysisAI
Improper cache handling in macOS allows attackers with physical access to recover deleted notes from memory. The vulnerability affects macOS Sequoia (before 15.7.2), macOS Sonoma (before 14.8.2), and macOS Tahoe (before 26.2), exposing sensitive user data through inadequate data sanitization. No public exploit code has been identified, and the extremely low EPSS score (0.02%) reflects the requirement for physical device access, making real-world exploitation unlikely outside of targeted scenarios involving stolen or temporarily compromised hardware.
Technical ContextAI
This vulnerability stems from CWE-524 (Use of Cache Containing Sensitive Information), a weakness in how macOS manages in-memory cache structures for the Notes application. When notes are deleted, the underlying cache memory is not properly overwritten or cleared, leaving data remnants accessible to anyone with direct physical access to the device. The issue involves the Notes framework's interaction with system memory management and cache eviction policies. While the specific technical mechanism isn't detailed, improved cache handling suggests that Apple implemented secure cache invalidation, likely involving explicit memory zeroing or reallocation strategies to prevent recovery of deleted content.
RemediationAI
Update to macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, or macOS Tahoe 26.2 or later. Users should navigate to System Settings > General > Software Update and install the latest available version for their macOS variant. Additionally, enable FileVault full-disk encryption and configure Find My Mac remote wipe capability to mitigate physical access threats. For enterprise deployments, enforce MDM policies requiring automatic security updates. Refer to Apple support articles https://support.apple.com/en-us/125635, https://support.apple.com/en-us/125636, and https://support.apple.com/en-us/125886 for detailed update instructions and release notes.
More from same product – last 7 days
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Dock
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape
Local privilege escalation in Apple macOS allows a malicious app already running with low privileges to elevate to root
Local privilege escalation in Canonical Multipass for macOS before 1.16.3 allows a low-privileged local user to obtain r
Share
External POC / Exploit Code
Leaving vuln.today