macOS Tahoe CVE-2025-43466

Exploitation requires an attacker-controlled or compromised application already executing locally on macOS (AV:L, PR:L) - there is no remote or network attack path. The specific affected feature or interface is not disclosed in the Apple advisory, which only states 'an app may be able to access sensitive user data' and that an injection issue was addressed through improved validation. Limiting factors: the attacker must first achieve local app execution on the target, the flaw is fixed in macOS Tahoe 26.1 (so only earlier/unpatched 26.x systems are exposed), and impact is confined to confidentiality (no integrity or availability effect).

This is a moderate-severity, local-access information disclosure flaw in macOS (CVSS 5.5). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates an attacker needs local access and low privileges - consistent with the description that 'an app may be able to access sensitive user data,' meaning a malicious or compromised application already running on the device, not a remote attacker. All three real-world threat signals point to LOW priority: EPSS is only 0.22% (12th percentile), the CVE is NOT in CISA KEV, and no public exploit code is identified. The high confidentiality impact (C:H) is offset by the local attack vector and the need for an attacker to first get code running on the host. No SSVC data was provided in the input. Signals are consistent with one another - there is no conflict here: a genuine confidentiality issue but one that requires prior foothold and shows no evidence of exploitation. Treat as routine patch-cycle remediation rather than an emergency, though organizations handling sensitive data on macOS should prioritize it above other 5.5-scored issues because the impact is data disclosure via the CWE-95 code injection weakness.

A user installs or runs a malicious or trojanized app on macOS; because of improper input validation (CWE-95 code injection), the app leverages the flaw to read sensitive user data it would otherwise be sandboxed or permission-gated from accessing. No public exploit code exists, and exploitation requires the attacker to already have an app executing locally with low privileges.