CVE-2025-43378: Apple macOS Information Disclosure Flaw

CVE-2025-43378 Overview

CVE-2025-43378 is a permissions vulnerability in Apple macOS that allows a locally installed application to access sensitive user data. Apple addressed the issue by applying additional restrictions in the affected components. The flaw is fixed in macOS Sequoia 15.7.2 and macOS Tahoe 26.1. It is categorized under [CWE-200] Information Exposure and requires user interaction on the local system to trigger. Exploitation does not require prior authentication, but the attacker must have code execution on the target device through an installed application.

Critical Impact
A malicious or compromised application on macOS can bypass permission controls to read sensitive user data without authorization.

Affected Products

Apple macOS versions prior to Sequoia 15.7.2
Apple macOS versions prior to Tahoe 26.1
Systems running third-party applications with local execution privileges

Discovery Timeline

2025-11-04 - CVE-2025-43378 published to NVD
2025-11-04 - Apple releases security patches in macOS Sequoia 15.7.2 and macOS Tahoe 26.1
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43378

Vulnerability Analysis

The vulnerability is an information disclosure issue caused by insufficient permission enforcement in macOS. An application running on the local system can leverage weaker-than-intended access controls to reach user data that should be restricted by the operating system's privacy framework. Apple's advisory describes the fix as adding additional restrictions to the affected permission logic, indicating that certain resource access paths were not fully gated by the expected entitlement or consent checks.

The issue falls under [CWE-200], Exposure of Sensitive Information to an Unauthorized Actor. The impact is limited to confidentiality; integrity and availability are not affected. Exploitation requires user interaction, meaning a user must launch or otherwise activate the malicious application.

Root Cause

Apple's advisory attributes the flaw to a permissions check that did not sufficiently constrain access to protected resources. Prior to the fix, the affected component granted access under conditions that should have required stricter validation. The patch introduces additional restrictions to close the gap.

Attack Vector

An attacker must deliver and execute an application on the target macOS system. Common delivery paths include social engineering, supply chain compromise of a legitimate application, or a malicious installer. Once running, the application queries the affected subsystem to retrieve sensitive user data without triggering the expected permission prompt or Transparency, Consent, and Control (TCC) enforcement.

Apple has not published proof-of-concept code, and no public exploit is available. See the Apple Support Article #125634 and Apple Support Article #125635 for vendor guidance.

Detection Methods for CVE-2025-43378

Indicators of Compromise

Unsigned or unexpectedly signed applications reading files under ~/Library, ~/Documents, or other TCC-protected directories
Processes accessing sensitive data stores without a corresponding user consent prompt in TCC.db audit trails
Unusual file read activity from recently installed third-party applications on macOS builds prior to 15.7.2 or 26.1

Detection Strategies

Monitor Endpoint Security framework events for ES_EVENT_TYPE_NOTIFY_OPEN calls targeting protected user data directories from non-Apple binaries
Correlate application install events with subsequent access to sensitive resources absent a TCC consent record
Baseline application behavior on managed macOS fleets and flag deviations that involve access to personal data locations

Monitoring Recommendations

Track the installed macOS version across the fleet and prioritize hosts still running builds earlier than 15.7.2 or 26.1
Log and review tccd and sandboxd messages in the unified log for anomalies
Alert on application executions from download and temporary directories that immediately touch user data folders

How to Mitigate CVE-2025-43378

Immediate Actions Required

Update all macOS Sequoia systems to version 15.7.2 and all macOS Tahoe systems to version 26.1
Inventory third-party applications and remove any that are unsigned, unnecessary, or untrusted
Restrict application installation privileges for standard users through mobile device management (MDM) policies

Patch Information

Apple has released fixes in macOS Sequoia 15.7.2 and macOS Tahoe 26.1. Refer to the Apple Support Article #125635 for the macOS Sequoia advisory and the Apple Support Article #125634 for the macOS Tahoe advisory. Both updates apply the additional permission restrictions that close the disclosure path.

Workarounds

Apply strict Gatekeeper and notarization enforcement to block unsigned applications from running
Use MDM configuration profiles to restrict TCC access and require administrator approval for privacy-sensitive entitlements
Limit installation of third-party software on managed endpoints until patches are deployed

bash

# Verify installed macOS version and enforce update via MDM
sw_vers -productVersion
sudo softwareupdate --install --all --restart