SB2025110422 - Multiple vulnerabilities in Apple macOS Tahoe

Description

This security bulletin contains information about 111 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-30465)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restriction sin Shortcuts. A local application can access files that are normally inaccessible to the Shortcuts app.

2) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43351)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in StorageKit. A local application can access protected user data.

3) Improper access control (CVE-ID: CVE-2025-43409)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Spotlight. A local application can access sensitive user data.

4) Improper input validation (CVE-ID: CVE-2025-43397)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in SoftwareUpdate. A local application can cause a denial-of-service.

5) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43336)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in SoftwareUpdate. A local application can access private information.

6) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2025-43399)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output in Siri. A local application can access protected user data.

7) Information exposure through log files (CVE-ID: CVE-2025-43477)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to inclusion of sensitive information into a log file in Siri. A local application can access sensitive user data.

8) Out-of-bounds write (CVE-ID: CVE-2025-43380)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds write in sips. A local application can trick the victim into opening a specially crafted file and perform an unexpected app termination.

9) Improper access control (CVE-ID: CVE-2025-43499)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Shortcuts. A local application can access sensitive user data.

10) State issues (CVE-ID: CVE-2025-43473)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Shortcuts. A local application can access sensitive user data.

11) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-43414)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restriction sin Shortcuts. A local application can access files that are normally inaccessible to the Shortcuts app.

12) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43476)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in SharedFileList. A local application can break out of its sandbox.

13) Protection mechanism failure (CVE-ID: CVE-2025-32462)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient implementation of security measures when running sudo with -h (--host) option. If the current configuration provides access to users based on the host they are allowed to execute commands, a local user can bypass such a restriction by providing the hostname via the "-h" option they are allowed to execute commands. The vulnerability affects systems that use a common sudoers file that is distributed to multiple machines or when LDAP-based sudoers (including SSSD) is used. 

14) Improper access control (CVE-ID: CVE-2025-43408)

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Share Sheet. An attacker with physical access to device can view contacts from the lock screen. 

15) Information disclosure (CVE-ID: CVE-2025-43335)

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to a missing logic in Security feature. A local application can gain access to sensitive information. 

16) Improper input validation (CVE-ID: CVE-2025-43500)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Sandbox Profiles. A local application can access sensitive user data.

17) Improper access control (CVE-ID: CVE-2025-43404)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Sandbox. A local application can access sensitive user data.

18) Improper access control (CVE-ID: CVE-2025-43406)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Sandbox. A local application can access sensitive user data.

19) Security features bypass (CVE-ID: CVE-2025-43502)

The vulnerability allows a local application to bypass certain Privacy preferences.

The vulnerability exists due to an error in Safari. A local application can bypass certain Privacy preferences.

20) Spoofing attack (CVE-ID: CVE-2025-43503)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can trick the victim into visiting a specially crafted website and spoof the user interface. 

21) Spoofing attack (CVE-ID: CVE-2025-43493)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can trick the victim into clicking on a specially crafted URL and spoof the browser's address bar.

22) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-6442)

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests within the read_header() method. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

23) Inefficient regular expression complexity (CVE-ID: CVE-2024-49761)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when parsing an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

24) Resource exhaustion (CVE-ID: CVE-2024-43398)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing XML with multiple deep elements that have same local name attributes. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

25) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2025-43463)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to incorrect handling of path names in StorageKit. A local application can trick the victim into opening a specially crafted file and access sensitive user data.

26) Improper access control (CVE-ID: CVE-2025-43334)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in sudo. A local application can access user-sensitive data.

27) Improper input validation (CVE-ID: CVE-2025-43391)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Photos. A local application can trick the victim into opening a specially crafted file and access sensitive user data.

28) Use after free (CVE-ID: CVE-2025-43434)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected Safari crash.

29) Input validation error (CVE-ID: CVE-2025-43472)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in zsh. A local application can execute arbitrary code with root privileges. 

30) Memory corruption (CVE-ID: CVE-2025-43402)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in WindowServer. A local application can cause unexpected system termination or corrupt process memory.

31) Memory corruption (CVE-ID: CVE-2025-43373)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Wi-Fi. A local application can cause unexpected system termination or corrupt kernel memory.

32) Improper access control (CVE-ID: CVE-2025-43392)

The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.

The vulnerability exists due to incorrect handling of cached data in WebKit Canvas. A remote attacker can trick the victim into visiting a specially crafted website and exfiltrate data cross-origin.

33) Buffer overflow (CVE-ID: CVE-2025-43421)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.

34) Buffer overflow (CVE-ID: CVE-2025-43429)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.

35) Use-after-free (CVE-ID: CVE-2025-43432)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

36) Buffer overflow (CVE-ID: CVE-2025-43431)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website. trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

37) Buffer overflow (CVE-ID: CVE-2025-43433)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website. trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

38) Use-after-free (CVE-ID: CVE-2025-43457)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

39) Improper access control (CVE-ID: CVE-2025-43412)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in TCC. A local application can trick the victim into opening a specially crafted file and break out of its sandbox.

40) Use-after-free (CVE-ID: CVE-2025-43438)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.

41) Input validation error (CVE-ID: CVE-2025-43440)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser. 

42) Buffer overflow (CVE-ID: CVE-2025-43425)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.

43) Buffer overflow (CVE-ID: CVE-2025-43435)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.

44) Buffer overflow (CVE-ID: CVE-2025-43441)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.

45) Input validation error (CVE-ID: CVE-2025-43443)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page and crash the browser. 

46) State issues (CVE-ID: CVE-2025-43427)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a state management issue in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.

47) Input validation error (CVE-ID: CVE-2025-43430)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into opening a specially crafted web page and crash the browser.

48) Input validation error (CVE-ID: CVE-2025-43458)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in WebKit. A remote attacker can trick the victim into opening a specially crafted web page and crash the browser.

49) Security features bypass (CVE-ID: CVE-2025-43480)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and exfiltrate data cross-origin.

50) Path traversal (CVE-ID: CVE-2025-53906)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences in zip.vim plugin. A remote attacker can trick the victim into opening a specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution. 

51) Improper access control (CVE-ID: CVE-2025-43393)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in quarantine. A local application can break out of its sandbox.

52) Improper access control (CVE-ID: CVE-2025-43405)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Photos. A local application can access user-sensitive data.

53) Improper access control (CVE-ID: CVE-2025-43471)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Admin Framework. A local application can access sensitive user data.

54) Protection Mechanism Failure (CVE-ID: CVE-2025-43407)

The vulnerability allows a local application to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures in Assets. A local application can break out of its sandbox.

55) Improper input validation (CVE-ID: CVE-2025-43401)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in CoreAnimation. A remote attacker can trick the victim into opening a specially crafted file and cause a denial-of-service.

56) Information exposure through log files (CVE-ID: CVE-2025-43426)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to inclusion of sensitive information into a log file in Contacts. A local application can access sensitive user data.

57) Improper link resolution before file access ('link following') (CVE-ID: CVE-2025-43461)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insecure symbolic link following in configd. A local application can access protected user data.

58) Improper link resolution before file access ('link following') (CVE-ID: CVE-2025-43395)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insecure symbolic link following in configd. A local application can access protected user data.

59) Improper link resolution before file access ('link following') (CVE-ID: CVE-2025-43448)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insecure symbolic link following in CloudKit. A local application can break out of its sandbox.

60) Improper link resolution before file access ('link following') (CVE-ID: CVE-2025-43394)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insecure symbolic link following in bootp. A local application can access protected user data.

61) Improper access control (CVE-ID: CVE-2025-43497)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in BackBoardServices. A local application can break out of its sandbox.

62) Information exposure through log files (CVE-ID: CVE-2025-43423)

The vulnerability allows an attacker with physical access to the system to gain access to sensitive information.

The vulnerability exists due to inclusion of sensitive information into a log file in Audio. An attacker with physical access to the system can view sensitive user information in system logging.

63) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2025-43465)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to incorrect handling of path names in ATS. A local application can trick the victim into opening a specially crafted file and access sensitive user data.

64) Improper link resolution before file access ('link following') (CVE-ID: CVE-2025-43446)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insecure symbolic link following in Assets. A local application can modify protected parts of the file system.

65) Use after free (CVE-ID: CVE-2025-43478)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in ASP TCP. A local application can cause unexpected system termination.

66) Improper access control (CVE-ID: CVE-2025-43436)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in CoreServices. A local application can enumerate installed apps on the device. 

67) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43378)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in AppleMobileFileIntegrity. A local application can access sensitive user data.

68) Improper link resolution before file access ('link following') (CVE-ID: CVE-2025-43379)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insecure symbolic link following in AppleMobileFileIntegrity. A local application can access protected user data.

69) Cryptographic issues (CVE-ID: CVE-2025-43468)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a cryptographic issue in AppleMobileFileIntegrity. A local application can access sensitive user data.

70) Improper limitation of a pathname to a restricted directory ('path traversal') (CVE-ID: CVE-2025-43382)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to incorrect handling of path names in AppleMobileFileIntegrity. A local application can trick the victim into opening a specially crafted file and access sensitive user data.

71) Improper input validation (CVE-ID: CVE-2025-43466)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in AppleMobileFileIntegrity. A local application can access sensitive user data.

72) Improper input validation (CVE-ID: CVE-2025-43388)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in AppleMobileFileIntegrity. A local application can access sensitive user data.

73) Cryptographic issues (CVE-ID: CVE-2025-43390)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a cryptographic issue in AppleMobileFileIntegrity. A local application can access user-sensitive data.

74) Memory corruption (CVE-ID: CVE-2025-43462)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Apple Neural Engine. A local application can cause unexpected system termination or corrupt kernel memory.

75) Memory corruption (CVE-ID: CVE-2025-43447)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Apple Neural Engine. A local application can cause unexpected system termination or corrupt kernel memory.

76) Improper access control (CVE-ID: CVE-2025-43455)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Apple Account. A local application can take a screenshot of sensitive information in embedded views.

77) Improper access control (CVE-ID: CVE-2025-43322)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in Admin Framework. A local application can access user-sensitive data.

78) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43479)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in CoreServices. A local application can access sensitive user data.

79) Link following (CVE-ID: CVE-2025-43381)

The vulnerability allows a local application to delete protected user data.

The vulnerability exists due to an insecure link following issue in CoreServicesUIAgent. A local application can delete protected user data. 

80) Improper access control (CVE-ID: CVE-2025-43411)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions in PackageKit. A local application can access user-sensitive data.

81) Improper access control (CVE-ID: CVE-2025-43413)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in libxpc. A local application can observe system-wide network connections.

82) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43469)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions in NSSpellChecker. A local application can access sensitive user data.

83) Improper input validation (CVE-ID: CVE-2025-43389)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Notes. A local application can access sensitive user data.

84) Improper error handling (CVE-ID: CVE-2025-43506)

The vulnerability allows an attacker to gain access to sensitive information.

the vulnerability exists due to incorrect error handling in Networking. iCloud Private Relay may not activate when more than one user is logged in at the same time, which can lead to information disclosure. 

85) Race condition (CVE-ID: CVE-2025-43364)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in NetFSFramework. A local user can exploit the race and break out of its sandbox.

86) Buffer overflow (CVE-ID: CVE-2025-43424)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Multi-Touch. A malicious HID device can crash the process. 

87) Memory corruption (CVE-ID: CVE-2025-43377)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Model I/O. A local application can cause a denial-of-service.

88) Memory corruption (CVE-ID: CVE-2025-43383)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

89) Memory corruption (CVE-ID: CVE-2025-43384)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

90) Memory corruption (CVE-ID: CVE-2025-43385)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

91) Memory corruption (CVE-ID: CVE-2025-43386)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in Model I/O. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

92) Security features bypass (CVE-ID: CVE-2025-43496)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a missing logic in Mail Drafts when working with email messages. A remote attacker can force the application to load remote content even when the 'Load Remote Images' setting is turned off.

93) Memory corruption (CVE-ID: CVE-2025-43398)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in Kernel. A local application can cause unexpected system termination.

94) Improper input validation (CVE-ID: CVE-2025-43445)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in CoreText. A local application can trick the victim into opening a specially crafted file and perform unexpected app termination or corrupt process memory.

95) Improper access control (CVE-ID: CVE-2025-43467)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Installer. A local application can gain root privileges.

96) Information disclosure (CVE-ID: CVE-2025-43444)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to excessive data output by the Installer application. A malicious local application can fingerprint the user.

97) Improper access control (CVE-ID: CVE-2025-43396)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Installer. A local application can access sensitive user data.

98) Improper input validation (CVE-ID: CVE-2025-43474)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in GPU Drivers. A local application can cause unexpected system termination or read kernel memory.

99) Improper input validation (CVE-ID: CVE-2025-43348)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to insufficient input validation in Finder. A local application can gain access to sensitive information.

100) Information disclosure (CVE-ID: CVE-2025-43507)

The vulnerability allows a local application to fingerprint the user.

The vulnerability exists due to excessive data output by the Find My application. A local application can fingerprint the user.

101) State issues (CVE-ID: CVE-2025-43498)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in FileProvider. A local application can access sensitive user data.

102) Improper input validation (CVE-ID: CVE-2025-43464)

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in dyld. A local application can perform an app denial-of-service.

103) State issues (CVE-ID: CVE-2025-43420)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a state management issue in Dock. A local application can access sensitive user data.

104) Permissions, privileges, and access controls (CVE-ID: CVE-2025-43387)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in DiskArbitration. A local application can gain root privileges.

105) Improper access control (CVE-ID: CVE-2025-43481)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in Disk Images. A local application can break out of its sandbox.

106) Incorrect default permissions (CVE-ID: CVE-2025-43470)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect default permissions. A local user can view files made from a disk image belonging to an administrator

107) Buffer overflow (CVE-ID: CVE-2025-43510)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and cause unexpected changes in memory shared between processes.

108) Buffer overflow (CVE-ID: CVE-2025-43520)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code on the target system.

109) Input validation error (CVE-ID: CVE-2025-43494)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of email headers in the Mail app. A remote attacker can send a specially crafted email to the victim and cause a persistent denial-of-service.

110) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2025-43508)

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to the Phone component stores sensitive information into log files. A local application can read the log files and gain access to sensitive data.

111) Out-of-bounds read (CVE-ID: CVE-2025-46316)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

Remediation

Install update from vendor's website.

References

• https://support.apple.com/en-us/125634