CVE-2025-43288

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-04

Last updated on: 2026-04-02

Assigner: Apple Inc.

Description

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to bypass Privacy preferences.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-04

Last Modified

2026-04-02

Generated

2026-07-06

AI Q&A

2025-11-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-43288

EUVD

EUVD-2025-37733

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	to 15.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves insufficient validation of symbolic links (symlinks) in macOS Sequoia before version 15.7. Due to this, an application may be able to bypass Privacy preferences, potentially accessing data or resources it should not be allowed to.

Impact Analysis

If exploited, this vulnerability could allow an application to bypass Privacy preferences on macOS Sequoia, potentially leading to unauthorized access to private user data or system resources that are normally protected.

Mitigation Strategies

Update your system to macOS Sequoia 15.7 or later, where the issue has been fixed with improved validation of symlinks to prevent apps from bypassing Privacy preferences.

Hi! I’m here to help you understand CVE-2025-43288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70