CVE-2025-43288

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43288", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-04-16T15:24:37.102Z", "datePublished": "2025-11-04T01:17:12.912Z", "dateUpdated": "2026-04-02T18:20:56.474Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "An app may be able to bypass Privacy preferences"}]}], "affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "15.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "26", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to bypass Privacy preferences."}], "references": [{"url": "https://support.apple.com/en-us/125110"}, {"url": "https://support.apple.com/en-us/125111"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:20:56.474Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-59", "lang": "en", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T17:48:13.339243Z", "id": "CVE-2025-43288", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T18:02:20.468Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-43288", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T17:48:13.339243Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T18:02:14.479Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "15.7", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/125111"}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7. An app may be able to bypass Privacy preferences."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "An app may be able to bypass Privacy preferences"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-11-04T01:17:12.912Z"}}}, "cveMetadata": {"cveId": "CVE-2025-43288", "state": "PUBLISHED", "dateUpdated": "2025-11-04T18:02:20.468Z", "dateReserved": "2025-04-16T15:24:37.102Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-11-04T01:17:12.912Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "15.7", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "26", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "C13E1327-B1AA-4A42-B063-48B2209D940A", "versionEndExcluding": "15.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to bypass Privacy preferences."}, {"lang": "es", "value": "Este problema se abord\u00f3 con una validaci\u00f3n mejorada de enlaces simb\u00f3licos. Este problema se corrigi\u00f3 en macOS Sequoia 15.7. Una aplicaci\u00f3n podr\u00eda eludir las preferencias de Privacidad."}], "id": "CVE-2025-43288", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43288", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T17:48:13.339243Z", "version": "2.0.3"}}]}, "published": "2025-11-04T02:15:35.570", "references": [{"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/125110"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/125111"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T23:10:03.290627+00:00", "value": {"mitigation_remediation": ["Upgrade macOS to at least Sequoia\u202f15.7 or Tahoe\u202f26 to incorporate the improved symlink validation.", "Configure application sandboxing or privacy preferences to restrict filesystem access to protected directories if the update cannot be applied immediately.", "Monitor system logs and alerts for unexpected symbolic\u2011link usage that might indicate a compromise."], "summary": {"action": "Apply Patch", "impact": "Bypass of Privacy Preferences via Symlink Exploit"}, "threat_synthesis": {"affected_systems": "Apple\u2019s macOS is impacted, specifically versions prior to the release that includes the fix. The vendor notes that the issue is addressed in macOS Sequoia 15.7 and macOS Tahoe 26; any earlier updates lack the validation fix and therefore remain vulnerable.", "description_and_impact": "The vulnerability arises from insufficient validation of symbolic links, allowing an application to construct or follow a symlink that points to a restricted location. An attacker could exploit this to bypass the operating system\u2019s privacy preferences, reading or modifying files that the user has explicitly denied access to. The weakness is a type of path traversal that permits unauthorized file access, aligning with the CWE-59 classification.", "risk_and_exploitability": "The CVSS score of 5.5 suggests a moderate severity, and the EPSS score of less than 1\u202f% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Although the attack vector is not explicitly documented, the nature of the flaw implies that a local or compromised application could exercise the privilege escalation, so environments running untrusted third\u2011party software without stringent sandboxing are most at risk."}}}}, "created": "2025-11-04T16:34:20.286932+00:00", "title": "Symlink Validation Allowing Privacy Preference Bypass", "updated": "2026-04-27T23:15:06.050149+00:00", "vendors": ["apple", "apple$PRODUCT$macos", "apple$PRODUCT$macos_sequoia"]}