CVE-2025-43305

CVE-2025-43305 is a logic issue in macOS that may allow a malicious app to access private information. The root cause is a flaw in permission checks that can be bypassed by an app, leading to unauthorized access to sensitive data.

To exploit this vulnerability, an attacker must have the ability to run a malicious app on the target system. No additional authentication or user interaction is required beyond installing the app. The attack vector is local, as the app must execute on the device.

Successful exploitation could allow the app to access private information such as user data or system settings, effectively bypassing Privacy preferences. This could lead to exposure of personal or confidential information.

The issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26. Users should update to these versions to mitigate the risk. Apple has released security updates for affected devices [1][3][4].