CVE-2025-43476CWE-284broken-access-control

CVE-2025-43476

High · published November 4, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

⚡ A sneaky permissions issue could let an app break free from its sandbox! 🚀 Think of it like a hotel room that forgot to lock its windows — a guest could easily crawl out. This flaw allows an app to escape its controlled environment and access resources that should be off-limits. An attacker could leverage this vulnerability to access sensitive data or even manipulate files on the host system! This breach could lead to unauthorized actions and a loss of privacy for users, resulting in potentially devastating consequences.

Put simply

Think of it like a hotel room that forgot to lock its windows — a guest could easily crawl out. This flaw allows an app to escape its controlled environment and access resources that should be off-limits. This vulnerability arises from insufficient restrictions on what a sandboxed application can access, allowing it to perform actions outside its intended privileges. Essentially, the app can request and receive permissions it shouldn't have, leading to security breaches.

What to do

An attacker could leverage this vulnerability to access sensitive data or even manipulate files on the host system! This breach could lead to unauthorized actions and a loss of privacy for users, resulting in potentially devastating consequences. To safeguard your system, update to macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, or macOS Tahoe 26.1 immediately to patch this vulnerability. Regularly review app permissions and maintain strong security practices to reduce risks. You've got this! Secure your device with these updates, and keep your digital space safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-11-04T07:15Z
Affected products (2)
ProductVersionsFixed in
apple/macos≥ 14.0, < 14.8.214.8.2
apple/macos≥ 15.0, < 15.7.215.7.2
References (3)
EPSS history
Timeline
  • 04 NOV 01:17Z
    A permissions issue was addressed with additional restrictions
    cvelistv5