CVE-2025-43513
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
2Description
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to read sensitive location information.
Analysis
Local arbitrary applications on macOS can read sensitive location information due to a permissions validation flaw (CWE-284), affecting macOS Sequoia, Sonoma, and Tahoe. The vulnerability requires user interaction to trigger but grants unauthorized access to location data without proper authorization checks. Apple has released patches in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2 to remediate the issue by removing the vulnerable code. No public exploit or active exploitation has been confirmed.
Technical Context
The vulnerability stems from improper permission enforcement in macOS's location data access controls, classified under CWE-284 (Improper Access Control - Permissions, Privileges, and Other Access Controls). The underlying issue involves the operating system's failure to properly validate application entitlements or permissions before granting access to sensitive location information APIs. This is a local privilege escalation vector where unprivileged or untrusted applications can bypass the normal permission prompts and access restrictions that protect location services. The affected technology spans macOS kernel-level permission enforcement mechanisms that should gate access to Core Location and related services, impacting all macOS versions mentioned in the patch releases.
Affected Products
Apple macOS operating system versions spanning Sequoia, Sonoma, and Tahoe are affected. The vulnerability impacts all macOS installations on these major versions prior to the security updates: macOS Sequoia before version 15.7.3, macOS Sonoma before version 14.8.3, and macOS Tahoe before version 26.2. The CPE identifiers cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* indicate the flaw affects the macOS platform broadly across these release branches. End users on any of these three macOS releases should apply the corresponding patch release to close the location data exposure vector.
Remediation
Apply the security updates released by Apple: macOS Sequoia users should upgrade to version 15.7.3 or later, macOS Sonoma users should upgrade to version 14.8.3 or later, and macOS Tahoe users should upgrade to version 26.2 or later. These patch releases remove the vulnerable code that permitted unauthorized location data access. Updates are available through the macOS Software Update mechanism (System Settings > General > Software Update) or by downloading directly from Apple's security updates page at https://support.apple.com/en-us/125886. No workarounds are available for unpatched systems; patching is the definitive remediation. Users unable to patch immediately should review and restrict location access permissions in System Settings > Privacy & Security > Location Services to limit potential exposure.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today