CVE-2025-43506

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43506", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-04-16T15:27:21.194Z", "datePublished": "2025-12-12T20:56:39.176Z", "dateUpdated": "2026-04-02T18:16:36.513Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "iCloud Private Relay may not activate when more than one user is logged in at the same time"}]}], "affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "26.1", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A logic error was addressed with improved error handling. This issue is fixed in macOS Tahoe 26.1. iCloud Private Relay may not activate when more than one user is logged in at the same time."}], "references": [{"url": "https://support.apple.com/en-us/125634"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:16:36.513Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-843", "lang": "en", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-12-16T15:23:16.661805Z", "id": "CVE-2025-43506", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T18:50:46.727Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-43506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T15:23:16.661805Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T15:23:19.261Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "26.1", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/125634"}], "descriptions": [{"lang": "en", "value": "A logic error was addressed with improved error handling. This issue is fixed in macOS Tahoe 26.1. iCloud Private Relay may not activate when more than one user is logged in at the same time."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "iCloud Private Relay may not activate when more than one user is logged in at the same time"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-12-12T20:56:39.176Z"}}}, "cveMetadata": {"cveId": "CVE-2025-43506", "state": "PUBLISHED", "dateUpdated": "2025-12-17T18:50:46.727Z", "dateReserved": "2025-04-16T15:27:21.194Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-12-12T20:56:39.176Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "26.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "081B6CCE-FFA4-409C-9353-15014F3AF436", "versionEndExcluding": "26.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A logic error was addressed with improved error handling. This issue is fixed in macOS Tahoe 26.1. iCloud Private Relay may not activate when more than one user is logged in at the same time."}, {"lang": "es", "value": "Se abord\u00f3 un error de l\u00f3gica con un manejo de errores mejorado. Este problema est\u00e1 corregido en macOS Tahoe 26.1. iCloud Private Relay podr\u00eda no activarse cuando m\u00e1s de un usuario ha iniciado sesi\u00f3n al mismo tiempo."}], "id": "CVE-2025-43506", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43506", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-16T15:23:16.661805Z", "version": "2.0.3"}}]}, "published": "2025-12-12T21:15:55.630", "references": [{"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/125634"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:42:40.884597+00:00", "value": {"mitigation_remediation": ["Update macOS to macOS Tahoe\u00a026.1 or later", "Until the update, avoid having more than one user logged in simultaneously to prevent Private Relay from activating", "Keep an eye on Apple\u2019s support pages for any further patches or workarounds"], "summary": {"action": "Apply Update", "impact": "Privacy Breach"}, "threat_synthesis": {"affected_systems": "Affected systems include Apple macOS operating systems, specifically those versions prior to macOS Tahoe\u00a026.1, where the iCloud Private Relay feature is present. Users who enable multiple logins on a single machine may experience the failure to activate Private Relay until the system is updated.", "description_and_impact": "The vulnerability is a logic error that was addressed with improved error handling. It causes iCloud Private Relay not to activate when more than one user logs in at the same time. The flaw is identified as a CWE-843 type inconsistency. The impact is that the privacy protection normally provided by Private Relay could be bypassed, leaving traffic unfiltered and potentially exposed, effectively a denial of privacy.", "risk_and_exploitability": "The CVSS score of 7.5 reflects a high severity, while the EPSS score of less than 1%% indicates a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation. Attackers would need to create a scenario where multiple users are logged in concurrently, which limits the attack surface largely to local or privileged users rather than remote attackers."}}}}, "created": "2025-12-14T21:16:01.560853+00:00", "title": "iCloud Private Relay may fail to activate when multiple users are logged in", "updated": "2026-04-22T20:45:27.089670+00:00", "vendors": ["apple", "apple$PRODUCT$macos", "apple$PRODUCT$macos_tahoe"]}