CVE-2025-43260
BaseFortify
Publication date: 2025-07-30
Last updated on: 2025-11-03
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | macos | to 14.7.7 (exc) |
| apple | macos | From 15.0 (inc) to 15.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows an app to hijack entitlements that are granted to other privileged apps, potentially gaining unauthorized privileges. It was addressed by improving data protection and fixed in macOS Sequoia 15.6 and macOS Sonoma 14.7.7.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow a malicious app to gain elevated privileges by hijacking entitlements from other privileged apps, potentially leading to unauthorized access or actions on the affected system.
What immediate steps should I take to mitigate this vulnerability?
Update your system to macOS Sequoia 15.6 or macOS Sonoma 14.7.7 or later, as these versions include the fix for this vulnerability.