CVE-2025-43408CWE-284broken-access-control

CVE-2025-43408

Low · published November 4, 2025

CVSS v3.1
2.4
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An attacker with physical access may be able to access contacts from the lock screen.

The record
Technical detail
CVSS v3.1
2.4 · LOW
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-11-04T07:15Z
Affected products (2)
ProductVersionsFixed in
apple/macos< 14.8.214.8.2
apple/macos≥ 15.0, < 15.7.215.7.2
References (3)
https://support.apple.com/en-us/125634 · [email protected]https://support.apple.com/en-us/125635 · [email protected]https://support.apple.com/en-us/125636 · [email protected]
EPSS history
Timeline
  • 04 NOV 01:15Z
    This issue was addressed by restricting options offered on a locked device
    cvelistv5