Authorization Flaw in Fantastical XPC Services by Flexibits
CVE-2025-8533

6.9MEDIUM

Key Information:

Vendor

Flexibits

Status
Fantastical
Vendor
CVE Published:
7 August 2025

What is CVE-2025-8533?

A security issue has been discovered in the XPC services of Fantastical, where the service fails to enforce appropriate client authorization checks. In the listener:shouldAcceptNewConnection method, it allows connections from any local process without verification. This vulnerability exposes the service to risks from any local, unprivileged process, which can connect to the XPC service and potentially exploit its methods. The flaw has been rectified in version 4.0.16.

Affected Version(s)

Fantastical MacOS 0 < 4.0.16

References

https://cert.pl/en/posts/2025/08/CVE-2025-8533
third-party-advisory
https://flexibits.com/fantastical
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karol Mazurek - Afine Team
SĹ‚awomir Zakrzewski - Afine Team
.
CVE-2025-8533 : Authorization Flaw in Fantastical XPC Services by Flexibits