CVE-2025-43461
BaseFortify
Publication date: 2025-12-12
Last updated on: 2025-12-15
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | macos | to 26.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves insufficient validation of symbolic links (symlinks) in macOS Tahoe before version 26.1. Due to this, an application may exploit the issue to access protected user data by following or manipulating symlinks improperly. The issue was fixed by improving symlink validation in macOS Tahoe 26.1.
How can this vulnerability impact me? :
An attacker could exploit this vulnerability to gain unauthorized access to protected user data on a macOS Tahoe system prior to version 26.1. This could lead to data exposure or compromise of sensitive information stored by the user.
What immediate steps should I take to mitigate this vulnerability?
Update your system to macOS Tahoe 26.1 or later, as this version includes the fix with improved validation of symlinks to prevent unauthorized access to protected user data.