CVE-2025-43387CWE-863broken-access-control

CVE-2025-43387

High · published November 4, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

⚡ A sneaky permissions flaw lets a crafty app gain root privileges! Imagine someone slipping through the back door of your house while you’re not looking. 🔥 This vulnerability is like a hotel with lax security protocols — an unauthorized guest could wander straight into the VIP lounge! Without proper checks, a malicious app can elevate its access level on macOS, potentially wreaking havoc. If exploited, an attacker could gain complete control over the system, allowing them to install malicious software, access sensitive data, and even take over other accounts. This could lead to absolute chaos, essentially handing over the keys to your digital kingdom!

Put simply

This vulnerability is like a hotel with lax security protocols — an unauthorized guest could wander straight into the VIP lounge! Without proper checks, a malicious app can elevate its access level on macOS, potentially wreaking havoc. This is a permissions issue where certain malicious applications could bypass restrictions to gain root access, ultimately compromising the security of the system. The flaw was addressed in macOS Sequoia 15.7.2 and macOS Tahoe 26.1, adding essential safeguards.

What to do

If exploited, an attacker could gain complete control over the system, allowing them to install malicious software, access sensitive data, and even take over other accounts. This could lead to absolute chaos, essentially handing over the keys to your digital kingdom! To protect your system, ensure you've updated to macOS Sequoia 15.7.2 or macOS Tahoe 26.1 immediately. Regularly review and restrict app permissions to prevent unauthorized access to sensitive areas on your device. You've got this! By updating and tightening your app permissions, you'll be back in control of your security in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00171 · 6.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-11-04T07:15Z
Affected products (1)
ProductVersionsFixed in
apple/macos< 15.7.215.7.2
References (2)
EPSS history
Timeline
  • 04 NOV 01:17Z
    A permissions issue was addressed with additional restrictions
    cvelistv5