CVE-2025-43358 Overview
CVE-2025-43358 is a permissions vulnerability in Apple's Shortcuts component affecting iOS, iPadOS, and macOS. A crafted shortcut can bypass sandbox restrictions and access resources outside its intended security boundary. Apple addressed the issue by adding sandbox restrictions in iOS 18.7, iPadOS 18.7, iOS 26, iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26. The weakness maps to [CWE-862] Missing Authorization and requires local access with low privileges to exploit.
Critical Impact
A malicious shortcut can escape sandbox controls to read, modify, or exfiltrate data outside its permitted scope, affecting confidentiality, integrity, and availability of the host device.
Affected Products
- Apple iOS and iPadOS prior to 18.7 and prior to 26
- Apple macOS Sonoma prior to 14.8 and macOS Sequoia prior to 15.7
- Apple macOS Tahoe prior to 26
Discovery Timeline
- 2025-09-15 - CVE-2025-43358 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43358
Vulnerability Analysis
The vulnerability resides in the Shortcuts subsystem, which executes user-defined automation workflows on Apple platforms. Shortcuts run inside a sandbox that limits filesystem, network, and inter-process access. Insufficient authorization checks allowed a specially crafted shortcut to perform actions outside those boundaries. Apple's advisory describes the remediation as adding sandbox restrictions, indicating the sandbox policy did not fully constrain the actions the shortcut could invoke.
The scope change indicates the vulnerable component impacts resources managed by a separate security authority. In practice, a shortcut that should only touch its own container can reach protected user data, other application containers, or system resources.
Root Cause
The root cause is a missing authorization check ([CWE-862]) inside the Shortcuts execution path. The runtime accepted shortcut actions without validating that the caller held the entitlement or sandbox permission required for the requested operation. Because Shortcuts can be shared, imported, and triggered by user interaction or automation triggers, an attacker-crafted shortcut can weaponize this gap.
Attack Vector
Exploitation requires local access and low privileges but no user interaction beyond running the shortcut. An attacker delivers a malicious shortcut through iCloud sharing links, messaging, email attachments, or a compromised application that installs shortcuts programmatically. Once the victim runs the shortcut, it invokes actions that bypass the sandbox to access files, credentials, or inter-process resources belonging to other applications or the system.
No public proof-of-concept, exploit tooling, or CISA KEV listing has been recorded for this issue. Technical detail beyond Apple's advisory language is not published. See the Apple Support Document #125110 for vendor guidance.
Detection Methods for CVE-2025-43358
Indicators of Compromise
- Installation of shortcuts from untrusted iCloud links, messaging apps, or sideloaded profiles preceding anomalous file access
- Shortcuts invoking actions that read protected directories, keychain items, or other application containers
- Unexpected background execution of the Shortcuts or WorkflowKit processes correlated with data access outside expected paths
Detection Strategies
- Inventory installed shortcuts across managed devices and flag those originating from external sources or unsigned publishers
- Correlate Shortcuts process telemetry with sensitive file access, network egress, or credential material reads on macOS endpoints
- Alert on macOS Unified Log entries from com.apple.shortcuts and sandboxd denials or scope violations near shortcut execution
Monitoring Recommendations
- Enable EDR file and process telemetry on macOS devices and forward Unified Logs for the Shortcuts subsystem to a central analytics platform
- Monitor MDM device posture for OS versions below the fixed builds and prioritize non-compliant devices
- Track outbound network activity from shortcut executions to detect exfiltration to attacker-controlled endpoints
How to Mitigate CVE-2025-43358
Immediate Actions Required
- Update all Apple endpoints to iOS 18.7, iPadOS 18.7, iOS 26, iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, or macOS Tahoe 26
- Audit installed shortcuts and remove any imported from untrusted sources or unknown publishers
- Restrict shortcut sharing and installation via MDM configuration profiles on managed fleets
- Educate users to reject shortcut installation prompts originating from unsolicited messages or links
Patch Information
Apple released fixes across all affected platforms. Refer to the vendor advisories: Apple Support #125108, Apple Support #125109, Apple Support #125110, Apple Support #125111, and Apple Support #125112. Apply the update matching each device's platform through Software Update or MDM-managed deployment.
Workarounds
- Disable the Shortcuts app via MDM restrictions where operationally feasible until patches are deployed
- Block installation of shortcuts from third parties by enforcing the "Allow Untrusted Shortcuts" restriction to off
- Limit iCloud sharing of shortcut files by policy and quarantine .shortcut attachments at the mail and messaging gateway
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
