CVE-2025-43198
Published: 30 July 2025
Summary
CVE-2025-43198 is a critical-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-3 enforces approved authorizations for logical access to protected user data, directly preventing apps from bypassing flawed access controls as in this CVE.
AC-6 applies least privilege to restrict app access to only necessary resources, mitigating unauthorized access to sensitive user data.
SI-2 ensures timely flaw remediation through patching, addressing the vulnerable code removal fix for this macOS access control vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper access control flaw directly enables unauthorized access to protected local user data (T1005) via exploitation for privilege escalation (T1068) without auth or interaction.
NVD Description
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access protected user data.
Deeper analysisAI
CVE-2025-43198 is a critical improper access control vulnerability (CWE-284) with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), affecting macOS systems. It enables an app to access protected user data by exploiting flawed access controls. The vulnerability was addressed in macOS Sequoia 15.6 and macOS Sonoma 14.7.7 through the removal of the vulnerable code.
Attackers require no privileges or user interaction and can exploit this remotely over a network with low complexity. A malicious app can leverage the flaw to bypass protections and gain high-impact access to sensitive user data, potentially compromising confidentiality, integrity, and availability.
Apple's security advisories detail the fix via code removal in the specified macOS updates, recommending immediate patching to macOS Sequoia 15.6 or Sonoma 14.7.7. Additional details are available in the referenced support pages (https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124150) and Full Disclosure mailing list posts (http://seclists.org/fulldisclosure/2025/Jul/32, http://seclists.org/fulldisclosure/2025/Jul/33).
Details
- CWE(s)