CVE-2025-43416
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2Description
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access protected user data.
Analysis
Local authenticated applications can access protected user data on macOS due to improper access control restrictions (CWE-284). This affects macOS Sequoia, Sonoma, and Tahoe across multiple versions and is fixed in Sequoia 15.7.3, Sonoma 14.8.3, and Tahoe 26.2. The vulnerability requires local access and authenticated user privileges to exploit, limiting real-world risk despite the confidentiality impact; no public exploit code or confirmed active exploitation has been identified.
Technical Context
This vulnerability stems from a logic flaw in macOS access control mechanisms (CWE-284: Improper Access Control). The issue allows applications running with user-level privileges on a local system to bypass restrictions intended to protect sensitive user data. Rather than a cryptographic weakness or authentication bypass, this is a privilege escalation or capability leakage issue where the operating system fails to properly enforce data access boundaries between application sandboxes or user contexts. The affected systems span three major macOS releases (Sequoia 15.x, Sonoma 14.x, and the newer Tahoe 26.x branch), indicating the flaw existed across multiple macOS generations before being identified and corrected.
Affected Products
The vulnerability affects multiple macOS operating system versions: macOS Sequoia (all versions prior to 15.7.3), macOS Sonoma (all versions prior to 14.8.3), and macOS Tahoe (all versions prior to 26.2). Specific vulnerable version ranges are not granularly specified in available data, but patches are available for all three major releases. Consult Apple security advisory https://support.apple.com/en-us/125887 and https://support.apple.com/en-us/125888 for exact version applicability and patch details.
Remediation
Apply the following vendor-released patches immediately: macOS Sequoia users should upgrade to 15.7.3 or later, macOS Sonoma users should upgrade to 14.8.3 or later, and macOS Tahoe users should upgrade to 26.2 or later. Users unable to patch immediately should review and restrict installed third-party applications, particularly those with unusual system permissions or those requesting broad file access, to reduce the risk of malicious apps exploiting this logic flaw. Detailed patch instructions and advisory information are available at https://support.apple.com/en-us/125886, https://support.apple.com/en-us/125887, and https://support.apple.com/en-us/125888.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today