CVE-2025-43288: 
macOS vulnerability analysis and mitigation

CVE-2025-43288 is a symlink validation vulnerability in macOS Archive Utility that allows a malicious app to bypass Privacy preferences. It affects macOS versions prior to Sequoia 15.7 and was disclosed by Apple on September 15, 2025, with the CVE formally published on November 3, 2025. The fix was also included in macOS Tahoe 26. It carries a CVSS v3.1 base score of 5.5 (Medium), assessed by CISA-ADP (Apple Advisory 15.7, Apple Advisory Tahoe).

The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access — 'Link Following'), meaning the Archive Utility component fails to properly validate symbolic links before resolving file paths. An attacker-controlled app can craft a malicious archive containing symlinks that, when processed by Archive Utility, redirect file operations to locations protected by macOS Privacy preferences (e.g., sensitive directories guarded by TCC — Transparency, Consent, and Control). Exploitation requires local access and user interaction (e.g., opening a crafted archive), but does not require elevated privileges. Apple addressed the issue with improved symlink validation (Apple Advisory 15.7).

Successful exploitation allows a malicious app to bypass macOS Privacy preferences enforced by the TCC framework, potentially gaining unauthorized access to protected user data or directories without triggering the expected permission prompts. The integrity impact is rated High (CVSS I:H), as an attacker could write to or manipulate files in privacy-protected locations. Confidentiality and availability are not directly impacted per the CVSS assessment, but the TCC bypass could serve as a stepping stone for further data access or persistence (Apple Advisory 15.7, Apple Advisory Tahoe).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-43288. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction, limiting its attractiveness for mass exploitation (Apple Advisory 15.7).

1. Craft a malicious archive: Create an archive (e.g., a ZIP or other supported format) containing a symlink that points to a TCC-protected directory or file (e.g., ~/Library/Safari or ~/Desktop).
2. Deliver the archive: Social-engineer the target user into downloading and opening the malicious archive on a vulnerable macOS system (prior to Sequoia 15.7).
3. Trigger Archive Utility: When the user double-clicks the archive, macOS Archive Utility automatically extracts its contents, following the embedded symlink without proper validation.
4. Bypass Privacy preferences: The symlink resolution causes Archive Utility to access or write to the TCC-protected location on behalf of the malicious app, bypassing the expected user consent prompt.
5. Achieve objective: The attacker's app can now read from or write to the protected location, potentially exfiltrating sensitive data or planting malicious files (Apple Advisory 15.7).

• File System: Unexpected symlinks within extracted archive contents pointing to sensitive directories (e.g., ~/Library/, ~/Desktop/, ~/Documents/); unusual files appearing in TCC-protected directories after archive extraction.
• Logs: macOS Unified Log entries from Archive Utility or com.apple.archiveutility showing file operations on TCC-protected paths without corresponding TCC consent dialogs; TCC log entries (/private/var/db/TCC/TCC.db) showing access grants not initiated by user interaction.
• Process: Archive Utility spawning child processes or performing file I/O to unexpected sensitive directories; unusual file access patterns from com.apple.archiveutility visible in fs_usage or opensnoop output.

Apple has released patches addressing this vulnerability in macOS Sequoia 15.7 and macOS Tahoe 26, both released September 15, 2025. Users should update to macOS Sequoia 15.7 or later immediately via System Settings > General > Software Update. No configuration-based workaround is available; upgrading is the only remediation. Users should also exercise caution when opening archives from untrusted sources (Apple Advisory 15.7, Apple Advisory Tahoe).

The vulnerability was discovered and reported by Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, who is credited in both the macOS Sequoia 15.7 and macOS Tahoe 26 security advisories. No significant public commentary, media coverage, or social media discussion specific to this CVE has been identified beyond the standard Apple security advisory publication (Apple Advisory 15.7, Apple Advisory Tahoe).