Symlink Vulnerability in Apple Operating Systems
CVE-2025-43220

9.8CRITICAL

Key Information:

Vendor

Apple
Status
iPad OS
Mac OS
Vendor
CVE Published:
30 July 2025

What is CVE-2025-43220?

A vulnerability exists in Apple's iPadOS and macOS that arises from inadequate validation of symlinks, allowing applications to potentially access protected user data. The issue has been addressed in the latest updates of affected operating systems, improving security by enhancing symlink validation mechanisms. Users are encouraged to update to the latest versions to mitigate any risks associated with this vulnerability.

Affected Version(s)

iPadOS < 17.7

macOS < 15.6

macOS < 14.7

References

https://support.apple.com/en-us/124148
https://support.apple.com/en-us/124149
https://support.apple.com/en-us/124150

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.