CVE-2025-43369: Apple macOS Privilege Escalation Vulnerability

CVE-2025-43369 Overview

CVE-2025-43369 is a symlink handling vulnerability in Apple macOS that allows a local application to access protected user data. Apple addressed the issue with improved symlink handling in macOS Tahoe 26. The flaw is categorized under [CWE-284] Improper Access Control and requires local access with user interaction to exploit. Because the vulnerability targets Apple's Transparency, Consent, and Control (TCC) protections, successful exploitation can expose files that macOS normally restricts to authorized applications.

Critical Impact
A malicious application running locally can bypass macOS access controls through symlink manipulation and read protected user data without authorization.

Affected Products

Apple macOS versions prior to macOS Tahoe 26
Applications relying on macOS TCC boundaries for file access enforcement
Local user accounts with the ability to install and run third-party applications

Discovery Timeline

2025-09-15 - CVE-2025-43369 published to the National Vulnerability Database
2025-09-15 - Apple releases macOS Tahoe 26 with the fix documented in Apple Support Article HT125110
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43369

Vulnerability Analysis

The vulnerability stems from improper handling of symbolic links within a macOS component that mediates access to protected user data. An application can create or reference a symlink that points to a location outside the intended access scope. When the vulnerable code follows the symlink without properly validating the resolved target, it grants access to files that should remain protected under macOS access control policies. Apple's advisory describes the impact as an application being able to access protected user data. This class of issue commonly affects directories governed by TCC, such as ~/Library, Documents, Downloads, and Desktop.

Root Cause

The root cause is inadequate validation of symlink targets before file operations complete. The affected code path resolves a user-controlled path without confirming that the resolved target remains within the authorized boundary. This maps to [CWE-284] Improper Access Control, where enforcement logic fails to account for indirect references. Apple's fix introduces stricter symlink handling to reject or safely resolve links that cross privilege boundaries.

Attack Vector

Exploitation requires local code execution and user interaction, typically in the form of launching or approving a malicious application. The attacker plants a symlink in a location the target process will traverse. When the process operates on the symlinked path, it inherits the attacker's redirection and reads or references data outside its granted scope. No network access, elevated privileges, or authentication is required beyond running an app as the current user. Additional technical context is available in the Full Disclosure Security Post.

Detection Methods for CVE-2025-43369

Indicators of Compromise

Unexpected symbolic links inside user directories such as ~/Library/Application Support, ~/Documents, or per-app container paths
Unsigned or ad-hoc signed applications performing readlink, symlink, or link operations against TCC-protected paths
TCC prompts or tccd log entries showing access requests immediately followed by file reads from unexpected paths

Detection Strategies

Monitor process telemetry for applications that create symlinks targeting protected directories shortly before performing file reads
Correlate fs_usage and Endpoint Security Framework events for ES_EVENT_TYPE_NOTIFY_CREATE on symlink types followed by ES_EVENT_TYPE_NOTIFY_OPEN against sensitive paths
Alert on applications outside the App Store or notarized set that access files inside another application's sandbox container

Monitoring Recommendations

Ingest macOS Unified Logs and Endpoint Security telemetry into a centralized data lake for retroactive hunting
Track macOS build versions across the fleet and flag hosts running versions earlier than macOS Tahoe 26
Review installed applications requesting Full Disk Access or Files and Folders permissions and validate their legitimacy

How to Mitigate CVE-2025-43369

Immediate Actions Required

Upgrade all affected Mac systems to macOS Tahoe 26 or later as documented in the Apple advisory
Audit third-party applications that request access to protected directories and remove any that are untrusted
Restrict installation of unsigned or non-notarized applications through Gatekeeper policy

Patch Information

Apple released the fix in macOS Tahoe 26. The remediation is described in Apple Support Article HT125110 as improved handling of symlinks. Administrators should deploy the update through Apple Software Update, MDM, or supervised update workflows and verify successful installation on every endpoint.

Workarounds

Limit user accounts from installing unapproved applications until the patch is applied
Review and revoke unnecessary TCC permissions under System Settings, Privacy and Security
Enforce Gatekeeper and notarization requirements to reduce the likelihood of running malicious local binaries

bash

# Verify macOS version and enforce Gatekeeper
sw_vers -productVersion
sudo spctl --master-enable
sudo softwareupdate --install --all --restart