CVE-2025-43220
Published: 30 July 2025
Summary
CVE-2025-43220 is a critical-severity Link Following (CWE-59) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 48.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of information inputs, directly addressing the insufficient symlink validation that allows apps to access protected user data.
Enforces approved authorizations for access to system resources, preventing symlink-based bypasses to protected user data.
Prevents unauthorized information transfer via shared system resources like filesystems exploited through symlinks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Symlink validation bypass (CWE-59) directly enables unauthorized access to protected files/data, facilitating local privilege escalation via malicious app.
NVD Description
This issue was addressed with improved validation of symlinks. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data.
Deeper analysisAI
CVE-2025-43220 is a symlink validation vulnerability (CWE-59) affecting Apple's iPadOS and macOS operating systems. The flaw enables an app to access protected user data due to insufficient checks on symlinks. It impacts iPadOS versions prior to 17.7.9 and macOS versions prior to Sequoia 15.6, Sonoma 14.7.7, and Ventura 13.7.7.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), signifying exploitation over a network with low complexity, no required privileges or user interaction, and high impacts across confidentiality, integrity, and availability. Remote attackers can leverage a malicious app to gain unauthorized access to, modify, or disrupt protected user data.
Apple's security advisories confirm the issue was resolved through enhanced symlink validation. Mitigation requires updating to iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, or macOS Ventura 13.7.7. Additional details are provided in support documents at https://support.apple.com/en-us/124148, https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124150, https://support.apple.com/en-us/124151, and http://seclists.org/fulldisclosure/2025/Jul/31.
Details
- CWE(s)