CVE-2025-43387 Overview
CVE-2025-43387 is a local privilege escalation vulnerability in Apple macOS. A malicious application running on an affected system can leverage an authorization flaw to gain root privileges. Apple addressed the issue by adding restrictions to the affected permission checks.
The vulnerability is categorized under [CWE-863: Incorrect Authorization]. Apple fixed the issue in macOS Sequoia 15.7.2 and macOS Tahoe 26.1. Exploitation requires local access with low privileges and no user interaction, according to the published CVSS vector.
Critical Impact
A malicious app running locally can escalate to root, gaining full control over the affected macOS system, including access to protected files, kernel interfaces, and system configuration.
Affected Products
- Apple macOS Sequoia prior to 15.7.2
- Apple macOS Tahoe prior to 26.1
- Applications and workloads relying on the vulnerable permission enforcement path
Discovery Timeline
- 2025-11-04 - CVE-2025-43387 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43387
Vulnerability Analysis
The flaw is an authorization issue in a macOS component. Apple's advisory states that the permission model did not sufficiently restrict access, allowing a locally executing malicious application to gain root privileges. The fix introduces additional restrictions on the affected permission logic.
Because the attack vector is local, an attacker must first execute code on the target host, typically through a signed-but-malicious application, a trojanized installer, or a compromised user account. Once running, the app can invoke the vulnerable code path to bypass the intended privilege boundary.
With root privileges, an attacker can disable security tooling, tamper with system extensions, install persistent kernel-adjacent components, and access data protected by System Integrity Protection controls that rely on process privilege levels.
Root Cause
The root cause is an incorrect authorization check [CWE-863] in a macOS component. The component performed a privileged action without adequately verifying that the caller was entitled to request it. Apple's remediation adds explicit restrictions rather than restructuring the underlying API, indicating a missing or overly permissive access-control decision.
Attack Vector
Exploitation requires local code execution with low privileges on the target Mac. An attacker delivers or drops a malicious application, executes it under a standard user context, and triggers the flawed code path to obtain root. No user interaction beyond initial app execution is required. Apple has not published exploit specifics, and no public proof-of-concept is available.
Refer to Apple's advisories for the affected component and technical details: Apple Support Article #125634 and Apple Support Article #125635.
Detection Methods for CVE-2025-43387
Indicators of Compromise
- Unexpected processes running as root that were spawned by user-level applications outside of /Applications or standard Apple paths.
- New or modified LaunchDaemons in /Library/LaunchDaemons/ or /System/Library/LaunchDaemons/ following execution of an untrusted app.
- Unsigned or ad-hoc signed binaries invoking privileged system APIs shortly after user login.
Detection Strategies
- Hunt for parent-child process chains where a standard-user GUI application spawns a child process executing as uid=0.
- Correlate sudo, authorization, and security subsystem log events with process creation telemetry to identify anomalous privilege transitions.
- Flag applications that request or receive elevated entitlements outside the Apple notarization and MDM-approved baseline.
Monitoring Recommendations
- Ingest macOS Endpoint Security Framework (ESF) and Unified Log events into a centralized analytics platform for privilege-transition analysis.
- Track installation of new privileged helper tools in /Library/PrivilegedHelperTools/ and alert on unsigned or untrusted publishers.
- Monitor macOS version inventory to identify hosts still running versions prior to 15.7.2 or 26.1.
How to Mitigate CVE-2025-43387
Immediate Actions Required
- Upgrade all affected Macs to macOS Sequoia 15.7.2 or macOS Tahoe 26.1 as soon as fleet testing allows.
- Restrict installation of unsigned or unnotarized applications through Gatekeeper policy and MDM configuration profiles.
- Audit local administrator accounts and remove standing local admin rights where not required.
Patch Information
Apple released fixes in macOS Sequoia 15.7.2 and macOS Tahoe 26.1. The advisory notes the issue was addressed with additional permission restrictions. See the Apple Sequoia 15.7.2 advisory and the Apple Tahoe 26.1 advisory for the full list of components and CVEs addressed.
Workarounds
- No official workaround has been published by Apple; patching is the supported remediation path.
- Reduce exposure by enforcing application allowlisting and blocking execution of untrusted binaries from user-writable directories such as ~/Downloads and /tmp.
- Limit user privileges to standard accounts and require administrator credentials for privileged actions via MDM policy.
# Verify installed macOS version against patched builds
sw_vers -productVersion
# Trigger a software update check (requires admin)
sudo softwareupdate --list
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
