CVE-2025-43381
BaseFortify
Publication date: 2025-12-12
Last updated on: 2025-12-15
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | macos | to 26.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
If exploited, this vulnerability could allow a malicious app to delete your protected user data, potentially leading to data loss and disruption of your system or personal files.
What immediate steps should I take to mitigate this vulnerability?
Update your macOS system to version Tahoe 26.1 or later, as this version includes the fix for the vulnerability involving improved handling of symlinks to prevent malicious apps from deleting protected user data.
Can you explain this vulnerability to me?
This vulnerability involves improper handling of symbolic links (symlinks) in macOS Tahoe 26.1. A malicious application could exploit this flaw to delete protected user data by manipulating symlinks.