CVE-2025-46307: Apple macOS Information Disclosure Flaw

CVE-2025-46307 Overview

CVE-2025-46307 is a logic flaw in Apple macOS that allows a local application to access sensitive user data. Apple addressed the issue with improved restrictions and released a fix in macOS Tahoe 26. The weakness is categorized under [CWE-284] Improper Access Control. Exploitation requires local code execution with low privileges and no user interaction, making it relevant to malicious or compromised applications already running on a target system.

Critical Impact

A local app can bypass access restrictions to read sensitive user data on unpatched macOS systems, undermining confidentiality controls enforced by the operating system.

Affected Products

• Apple macOS versions prior to macOS Tahoe 26
• Systems where local applications run without enforced sandbox restrictions
• macOS endpoints that have not applied the Apple security update referenced in Apple advisory 125110

Discovery Timeline

• 2026-05-26 - CVE-2025-46307 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2025-46307

Vulnerability Analysis

The vulnerability stems from a logic issue in the access control checks that gate sensitive user data on macOS. An application running locally with low privileges can leverage the flaw to reach data that the operating system should protect. Apple's advisory describes the resolution as improved restrictions, indicating that the previous logic did not fully constrain the conditions under which protected resources could be accessed.

The CVSS vector indicates a confidentiality-only impact with no effect on integrity or availability. Attack complexity is low, but the local attack vector means an adversary must already have code execution on the host. This aligns with post-compromise scenarios where an attacker pivots through a malicious app, a trojanized installer, or a sandboxed process attempting to escape data access boundaries.

Root Cause

The root cause is improper access control [CWE-284] in a macOS component that evaluates whether a requesting app is permitted to read certain user data. Apple's fix tightens these restrictions, suggesting a missing or insufficient permission check in the affected code path.

Attack Vector

An attacker with the ability to run an application locally on the target macOS device crafts requests that pass through the flawed access control logic. The request reaches sensitive user data without triggering the expected denial. No user interaction or elevated privileges are required beyond standard app execution rights.

No public exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data indicates a low likelihood of exploitation at this time. See the Apple Support Document for vendor technical details.

Detection Methods for CVE-2025-46307

Indicators of Compromise

• Unexpected process activity from non-Apple-signed or recently installed applications attempting to access user data directories such as ~/Library, ~/Documents, or TCC-protected resources
• Anomalous reads of protected files by processes that have not previously requested those entitlements
• Installation of applications from unverified sources shortly before suspicious data access events

Detection Strategies

• Monitor Endpoint Security framework events (ES_EVENT_TYPE_NOTIFY_OPEN, ES_EVENT_TYPE_NOTIFY_READDIR) for processes accessing sensitive paths outside their declared entitlements
• Correlate TCC (Transparency, Consent, and Control) prompts and denials with subsequent successful access events on the same paths
• Track macOS version inventory against the Apple Tahoe 26 release to identify unpatched endpoints

Monitoring Recommendations

• Enable unified logging collection for com.apple.TCC and access control subsystems and forward to a centralized analytics platform
• Baseline normal application behavior for sensitive data paths and alert on deviations
• Review installed third-party applications and validate their notarization status and developer identity

How to Mitigate CVE-2025-46307

Immediate Actions Required

• Upgrade affected macOS endpoints to macOS Tahoe 26 or later as documented in the Apple advisory
• Restrict installation of applications to those from the Mac App Store or notarized developers using MDM policies
• Review and revoke unnecessary Full Disk Access and other privacy entitlements granted to third-party apps

Patch Information

Apple released the fix in macOS Tahoe 26. The vendor documents the update and affected components in the Apple Support Document. Administrators should deploy the update through Apple Software Update or an MDM such as Jamf, Intune, or Kandji.

Workarounds

• Limit local user accounts to standard (non-administrator) privileges to reduce the scope of installable applications
• Use MDM configuration profiles to enforce Gatekeeper, System Integrity Protection, and restrictive Privacy preferences
• Remove or quarantine untrusted applications until the macOS update is applied

# Verify the installed macOS version on managed endpoints
sw_vers -productVersion

# Trigger a software update check and install available updates
sudo softwareupdate --list
sudo softwareupdate --install --all --restart