Symlink Bypass Vulnerability in macOS Sequoia by Apple
CVE-2025-43288

5.5MEDIUM

Key Information:

Vendor

Apple
Status
Mac OS
Vendor
CVE Published:
4 November 2025

What is CVE-2025-43288?

A vulnerability exists in macOS Sequoia that allows an app to potentially bypass system Privacy preferences through improper validation of symbolic links. This issue compromises user privacy and requires users to update to macOS Sequoia 15.7, which includes enhancements to link validation to mitigate this threat.

Affected Version(s)

macOS < 15.7

References

https://support.apple.com/en-us/125111

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.