CVE-2025-43345: 
macOS vulnerability analysis and mitigation

CVE-2025-43345 is a kernel-level correctness issue in multiple Apple operating systems that allows a malicious app to access sensitive user data. The vulnerability was disclosed by Apple on September 15, 2025, and formally published to NVD on November 3, 2025. It affects iOS and iPadOS prior to 18.7, macOS Sonoma prior to 14.8, macOS Sequoia prior to 15.7, and all versions of tvOS, watchOS, and visionOS prior to version 26. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), assessed by CISA-ADP (Apple Advisory iOS 26, Apple Advisory iOS 18.7, Apple Advisory macOS Sequoia, Apple Advisory macOS Sonoma).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and resides in the Kernel component of affected Apple platforms. Apple describes it as a "correctness issue" that was addressed with improved checks, indicating a logic or validation flaw in kernel-level data handling that could be leveraged by a locally installed app to read sensitive user data it should not have access to. Exploitation requires local access and user interaction (e.g., a user running a malicious app), and no privilege escalation is needed to trigger the flaw. The vulnerability was discovered and reported by Mickey Jin (@patch1t) (Apple Advisory iOS 26, Apple Advisory macOS Sequoia).

Successful exploitation allows a malicious application to access sensitive user data that should be protected by the operating system's access controls, resulting in a high confidentiality impact. There is no integrity or availability impact. Because the flaw is in the kernel, the scope of accessible data could include personal information, credentials, or other protected content stored on the device. The attack is limited to local access and requires user interaction, reducing the risk of mass exploitation but making it relevant in targeted attack scenarios (Apple Advisory iOS 18.7, Apple Advisory macOS Sonoma).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. No threat actor attribution has been identified (Feedly Intelligence).

Apple has released patches across all affected platforms. Users should update to the following versions or later: iOS 18.7 and iPadOS 18.7, macOS Sonoma 14.8, macOS Sequoia 15.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, watchOS 26, and visionOS 26. No configuration-based workaround is available; updating to a patched version is the only recommended remediation. Additionally, users should exercise caution when installing apps from unknown sources and review app permissions to limit access to sensitive data (Apple Advisory iOS 18.7, Apple Advisory macOS Sequoia, Apple Advisory macOS Sonoma).