CVE-2025-43358CWE-862broken-access-control

CVE-2025-43358

High · published September 16, 2025

CVSS v3.1

8.8

EPSS

Percentile

21.9

In the wild

Unconfirmed

What it is

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A shortcut may be able to bypass sandbox restrictions.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00303 · 21.9th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2025-09-16T03:15Z

Affected products (4)

Product	Versions	Fixed in
apple/ipados	< 18.7	18.7
apple/iphone_os	< 18.7	18.7
apple/macos	≥ 14.0, < 14.8	14.8
apple/macos	≥ 15.0, < 15.7	15.7

References (9)

https://support.apple.com/en-us/125108 · [email protected]https://support.apple.com/en-us/125109 · [email protected]https://support.apple.com/en-us/125110 · [email protected]https://support.apple.com/en-us/125111 · [email protected]https://support.apple.com/en-us/125112 · [email protected]http://seclists.org/fulldisclosure/2025/Sep/49 · af854a3a-2127-422b-91ae-364da2661108 http://seclists.org/fulldisclosure/2025/Sep/53 · af854a3a-2127-422b-91ae-364da2661108 http://seclists.org/fulldisclosure/2025/Sep/54 · af854a3a-2127-422b-91ae-364da2661108 http://seclists.org/fulldisclosure/2025/Sep/55 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

15 SEP 22:35Z
A permissions issue was addressed with additional sandbox restrictions
cvelistv5