macOS
CVE-2025-43522
LOW
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to access user-sensitive data.
AnalysisAI
Intel-based Mac computers running macOS Sequoia prior to 15.7.3 or macOS Tahoe prior to 26.2 are vulnerable to a cryptographic downgrade attack that allows unprivileged local applications to bypass code-signing restrictions and access sensitive user data. The vulnerability exploits inadequate validation of signed components, enabling information disclosure through JWT or similar signed-data attacks. Active exploitation has not been confirmed, and the extremely low EPSS score (0.01%) indicates minimal real-world exploitation risk despite the local attack vector.
Technical ContextAI
The vulnerability involves improper validation of code signatures on Intel-based macOS systems, specifically related to cryptographic signature verification mechanisms (CWE-347: Improper Verification of Cryptographic Signature). The issue allows a downgrade attack where an application can bypass or weaken code-signing protections that normally enforce code integrity. The 'JWT Attack' tag suggests the weakness may relate to how signed tokens or certificates are validated, potentially allowing an attacker to present older or weaker signature formats that are still accepted by the validation logic. The vulnerability is specific to Intel processors on macOS (cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*) and affects the operating system's core code-signing enforcement mechanisms.
RemediationAI
Vendor-released patch: Update to macOS Sequoia 15.7.3 or macOS Tahoe 26.2 or later. Users on Intel-based Mac computers should immediately apply the corresponding security update for their operating system version. Apple has addressed this issue by implementing additional code-signing restrictions to prevent downgrade attacks. Detailed patching instructions and compatibility information are available at https://support.apple.com/en-us/125886. Users unable to patch immediately should minimize the installation and execution of untrusted applications from non-official sources, as the vulnerability requires local code execution with low privileges to exploit.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today