CVE-2025-43245

A downgrade issue was addressed with additional code-signing restrictions

Critical · published July 29, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

🚨 A sneaky downgrade vulnerability could let rogue apps access your most sensitive user data! 🔥 Think of it as a hotel where the front desk mistakenly allows a guest to downgrade their room to a cheaper one, giving them access to areas meant for premium guests only. All it takes is a crafty request to slip through the security checks! If exploited, an attacker could gain access to protected user data, potentially leading to identity theft, privacy breaches, or unauthorized actions on behalf of the user. This could be absolutely devastating for anyone relying on their device for personal and sensitive information!

Put simply

Think of it as a hotel where the front desk mistakenly allows a guest to downgrade their room to a cheaper one, giving them access to areas meant for premium guests only. All it takes is a crafty request to slip through the security checks! This vulnerability arises from insufficient code-signing restrictions, allowing an app to bypass security measures and access protected user data. The issue has been resolved in macOS Sequoia 15.6, Sonoma 14.7.7, and Ventura 13.7.7.

What to do

If exploited, an attacker could gain access to protected user data, potentially leading to identity theft, privacy breaches, or unauthorized actions on behalf of the user. This could be absolutely devastating for anyone relying on their device for personal and sensitive information! To protect yourself, upgrade your macOS to one of the fixed versions immediately: Sequoia 15.6, Sonoma 14.7.7, or Ventura 13.7.7. Regularly check for updates to ensure you're protected against any new vulnerabilities! You've got this! Update your system and keep your data secure! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00703 · 52.7th percentile
Published
2025-07-29T23:35Z
EPSS history
Timeline
  • 29 JUL 23:35Z
    A downgrade issue was addressed with additional code-signing restrictions
    cvelistv5