Improper Link Resolution in AWS VPN Client for macOS
CVE-2025-11462

9.3CRITICAL

Key Information:

Vendor

Aws

Status
Client Vpn
Vendor
CVE Published:
7 October 2025

What is CVE-2025-11462?

The AWS VPN Client for macOS suffers from an improper link resolution vulnerability that may allow local users to execute arbitrary code with elevated privileges. This arises due to inadequate validation of the log destination directory during log rotation. A non-administrator could exploit this by creating a symlink from a client log file to a privileged directory. If successful, crafted API calls could cause the log file to execute the injected arbitrary code with root privileges, posing a significant security risk. Users are advised to upgrade to AWS VPN Client for macOS version 5.2.1 or the latest to mitigate this risk.

Affected Version(s)

Client VPN MacOS 1.3.2 < 5.2.1

References

https://aws.amazon.com/vpn/client-vpn-download/
patchproduct
https://aws.amazon.com/security/security-bulletins/AWS-20...
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-11462 : Improper Link Resolution in AWS VPN Client for macOS