CVE-2025-43407CWE-284broken-access-control

CVE-2025-43407

High · published November 4, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

⚡ An app might just break out of its digital playpen! This high-severity vulnerability allows apps to escape their sandbox in iOS and macOS. 🔥 Imagine a hotel room with a strict keycard system that usually keeps guests in their designated rooms. If a sneaky guest figures out how to unlock the main doors, they can wander into any room they want! This could lead to an attacker accessing sensitive user data or even tampering with other apps and settings. The fallout could be absolutely devastating, as affected users may unknowingly expose personal information or suffer from malicious changes. It's a breach of trust and security that nobody wants to face!

Put simply

Imagine a hotel room with a strict keycard system that usually keeps guests in their designated rooms. If a sneaky guest figures out how to unlock the main doors, they can wander into any room they want! CVE-2025-43407 involves an entitlement flaw that allows an app to bypass its sandbox restrictions. When entitlements aren't properly enforced, it opens the door for unauthorized access to system resources or other apps.

What to do

This could lead to an attacker accessing sensitive user data or even tampering with other apps and settings. The fallout could be absolutely devastating, as affected users may unknowingly expose personal information or suffer from malicious changes. It's a breach of trust and security that nobody wants to face! Update your devices to iOS 18.7.2, iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, or any other specified versions to close this security hole. Regularly check for updates and ensure your apps are maintained to prevent potential exploitation. You’ve got this! Stay vigilant and keep your devices secure with those updates. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-11-04T07:15Z
Affected products (6)
ProductVersionsFixed in
apple/ipados< 26.126.1
apple/iphone_os< 26.126.1
apple/macos≥ 14.0, < 14.8.214.8.2
apple/macos≥ 15.0, < 15.7.215.7.2
apple/tvos< 26.126.1
apple/visionos< 26.126.1
References (7)
EPSS history
Timeline
  • 04 NOV 01:17Z
    This issue was addressed with improved entitlements
    cvelistv5