CVE-2025-43351: 
macOS vulnerability analysis and mitigation

CVE-2025-43351 is a permissions/improper access control vulnerability in Apple macOS that allows a locally-installed app to access protected user data. It affects all macOS versions prior to macOS Tahoe 26.1 and was fixed in that release on November 3, 2025. The vulnerability was discovered by Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova and reported to Apple. It carries a CVSS v3.1 base score of 5.5 (Medium) (Apple Advisory, NVD).

The vulnerability is classified as CWE-284 (Improper Access Control) and resides in the StorageKit component of macOS Tahoe. Apple addressed the issue by implementing additional restrictions on permissions, suggesting that the root cause was insufficient enforcement of access controls that allowed an app to bypass protections and read user data it should not have access to. The attack vector is local, requires low privileges, and no user interaction, meaning a malicious app running on the system with standard user-level access could exploit this flaw without any additional conditions (Apple Advisory, NVD).

Successful exploitation allows a malicious application to access protected user data on the affected macOS system, resulting in a high confidentiality impact. There is no integrity or availability impact. The scope is limited to the local system, but sensitive personal data stored and managed by StorageKit could be exposed to an unauthorized app (Apple Advisory, NVD).

Apple has released a fix in macOS Tahoe 26.1, released November 3, 2025. Users and administrators should update all affected macOS systems to macOS Tahoe 26.1 or later. No workarounds are documented; upgrading to the patched release is the only recommended remediation (Apple Advisory).

The vulnerability was noted in the SANS Internet Storm Center diary covering the macOS Tahoe 26.1 security update, which addressed a large number of CVEs across many components. The CIS Security advisory also referenced the broader Apple update as addressing multiple vulnerabilities that could allow for arbitrary code execution and data access. No significant individual researcher commentary or social media discussion specific to CVE-2025-43351 has been identified (SANS ISC, CIS Advisory).