CVE-2025-43267: 
macOS vulnerability analysis and mitigation

An injection vulnerability (CVE-2025-43267) was discovered in macOS Sequoia's Directory Utility component, which was disclosed on July 29, 2025. The vulnerability affects versions prior to macOS Sequoia 15.6 and could allow an application to access sensitive user data through improper validation (Apple Support, NVD).

The vulnerability is classified as an injection issue that was addressed with improved validation mechanisms. It has been assigned a CVSS 3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability is associated with CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (CISA Advisory).

When successfully exploited, this vulnerability allows a malicious application to access sensitive user data. The attack requires local access and user interaction, but does not require special privileges to execute (NVD).

The vulnerability requires local access and user interaction to exploit. As of July 31, 2025, there are no reports of this vulnerability being exploited in the wild (CISA Advisory).

Apple has addressed this vulnerability in macOS Sequoia 15.6. Users are strongly advised to update their systems to this version to mitigate the risk. The fix includes improved validation mechanisms to prevent unauthorized access to sensitive user data (Apple Support).

The vulnerability was discovered and reported by security researcher Mickey Jin (@patch1t). The security community has classified this as a medium-severity issue, primarily due to its local access requirement and the availability of a patch (ASEC).