CVE-2025-43189
Published: 30 July 2025
Summary
CVE-2025-43189 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 32.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-43189 is a memory handling vulnerability in macOS that enables a malicious app to read kernel memory. The issue, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), affects macOS Sequoia versions prior to 15.6 and macOS Sonoma versions prior to 14.7.7. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to high impacts on confidentiality, integrity, and availability.
An attacker can exploit this vulnerability by delivering and executing a malicious app on the target system. The vector requires no privileges or user interaction beyond app execution, with potential network accessibility. Exploitation allows reading of kernel memory, leading to unauthorized exposure of sensitive data and broader system compromise.
Apple addressed the vulnerability with improved memory handling in macOS Sequoia 15.6 and macOS Sonoma 14.7.7. Mitigation involves updating to these patched versions, as detailed in Apple's security content updates at https://support.apple.com/en-us/124149 and https://support.apple.com/en-us/124150, along with disclosures on the Full Disclosure mailing list at http://seclists.org/fulldisclosure/2025/Jul/32 and http://seclists.org/fulldisclosure/2025/Jul/33.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23055
Vulnerability details
This issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to read kernel memory.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel memory read from malicious app directly enables credential access/dumping and facilitates privilege escalation via sensitive kernel data exposure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-16 directly enforces memory protection mechanisms to prevent malicious apps from unauthorized access to kernel memory.
SI-2 ensures timely identification, reporting, and correction of memory handling flaws like CVE-2025-43189 through patching.
CM-11 restricts user-installed software to prevent execution of malicious apps that exploit the kernel memory vulnerability.