CVE-2025-43345

Vulnerability

Overview

CVE-2025-43345 is a correctness issue in Apple's handling of symbolic links (symlinks) that could allow an application to bypass Privacy preferences and access sensitive user data. The root cause was a failure to properly validate symlinks, which Apple addressed with improved validation checks in the affected software versions [1], [4].

Exploitation

An attacker would need to have an app running on a vulnerable device, as the flaw is triggered locally. No additional authentication or special network position is required beyond the app's existing capabilities. The vulnerability arises when the app interacts with the file system through symlinks that are not correctly verified, potentially allowing it to reach protected data [1], [4].

Impact

Successful exploitation enables an app to bypass Privacy preferences, meaning it could read sensitive user data that would otherwise be restricted. The impact is limited to local access and does not allow remote code execution or escalation to kernel-level privileges, but it represents a significant privacy concern [1].

Mitigation

Apple patched this vulnerability in a coordinated release on September 15, 2025, across multiple platforms: iOS 18.7, iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26 [1], [2], [3], [4]. Users should update to the latest available versions to mitigate the risk. Apple's security advisories note that the company does not disclose, discuss, or confirm security issues until patches are available [1].