CVE-2025-43390
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-04

Last updated on: 2025-12-17

Assigner: Apple Inc.

Description
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-04
Last Modified
2025-12-17
Generated
2026-06-16
AI Q&A
2025-11-04
EPSS Evaluated
2026-06-14
NVD
CVE-2025-43390
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apple macos to 15.7.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a downgrade issue affecting Intel-based Mac computers, where an app may bypass security by exploiting weaker code-signing restrictions. It was addressed by adding stricter code-signing requirements in macOS Sequoia 15.7.2.

Impact Analysis

An app exploiting this vulnerability may be able to access user-sensitive data on affected Intel-based Mac computers, potentially leading to unauthorized data exposure.

Mitigation Strategies

Update your Intel-based Mac computers to macOS Sequoia 15.7.2 or later, as this version includes the fix for the vulnerability by adding additional code-signing restrictions.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-43390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart