CVE-2025-43257
Published: 02 April 2026
Summary
CVE-2025-43257 is a high-severity Link Following (CWE-59) vulnerability in Apple Macos. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SC-50 (Software-enforced Separation and Policy Enforcement).
Deeper analysis
CVE-2025-43257 is a vulnerability stemming from improper handling of symlinks, classified under CWE-59. It affects macOS Sequoia versions prior to 15.6, where a sandboxed app can potentially escape its containment.
The vulnerability has a CVSS v3.1 base score of 8.7 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L), indicating exploitation requires local access, low privileges, low complexity, and no user interaction. A malicious app running within a sandbox can leverage this flaw to break out, achieving high impacts on confidentiality and integrity across the system's scope, with a low impact on availability.
Apple's advisory confirms the issue was fixed in macOS Sequoia 15.6 via improved symlink handling. Practitioners should apply this update promptly; see https://support.apple.com/en-us/124149 for full details.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209197
Vulnerability details
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be able to break out of its sandbox.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct sandbox escape via symlink mishandling enables local exploitation for privilege escalation from a low-privileged sandboxed context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely identification, reporting, and correction of the improper symlink handling flaw fixed in macOS 15.6.
Enforces sandbox containment through software isolation and policy mechanisms that address symlink-based breakout attempts by malicious apps.
Implements a tamper-proof reference monitor for the sandbox to mediate all access decisions, preventing symlink traversal exploits.