CVE-2025-43519

MEDIUM
2025-12-12 [email protected]
5.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Apr 02, 2026 - 19:37 vuln.today
CVE Published
Dec 12, 2025 - 21:15 nvd
MEDIUM 5.5

Tags

Apple macOS Information Disclosure

Description

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.

Analysis

Local privilege escalation in macOS allows authenticated applications to access sensitive user data through insufficient permission restrictions on Sequoia, Sonoma, and Tahoe versions. The vulnerability requires local access and low-privilege user context but enables high-impact confidentiality compromise without requiring user interaction or elevated privileges to trigger. A vendor-released patch is available across all affected macOS versions.

Technical Context

This vulnerability exploits improper permission controls in macOS's access control framework, classified under CWE-276 (Incorrect Default Permissions). The underlying issue involves insufficient restriction on inter-process communication or file system access permissions that allow unprivileged application processes to read sensitive user data normally protected by macOS's sandbox and permission model. The affected CPE entries indicate the vulnerability spans multiple macOS major versions (Sequoia 15.x, Sonoma 14.x, and Tahoe 26.x), suggesting a systemic permissions configuration issue rather than a single component flaw.

Affected Products

This vulnerability affects multiple macOS releases across three major versions: macOS Sequoia (all versions prior to 15.7.3), macOS Sonoma (all versions prior to 14.8.3), and macOS Tahoe (all versions prior to 26.2). The affected product identifiers are represented by CPE entries cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* for each affected major version. Additional details and affected build numbers are documented in Apple Security Advisories HT125886, HT125887, and HT125888.

Remediation

Vendor-released patches are available for all affected macOS versions: upgrade to macOS Sequoia 15.7.3 or later, macOS Sonoma 14.8.3 or later, or macOS Tahoe 26.2 or later. Users should apply these security updates immediately via System Settings > General > Software Update. No workarounds are documented for this permission-based issue prior to patching. Refer to Apple Security Advisory HT125886 for Sequoia, HT125887 for Sonoma, and HT125888 for Tahoe for detailed remediation guidance and build verification.

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +28
POC: 0

Share

CVE-2025-43519 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy