CVE-2025-43382: 
macOS vulnerability analysis and mitigation

CVE-2025-43382 is a path traversal vulnerability (CWE-22) in Apple macOS CoreServices (and AppleMobileFileIntegrity in macOS Tahoe) caused by a parsing issue in the handling of directory paths. It affects macOS Sonoma 14.0–14.8.1 and macOS Sequoia 15.0–15.7.1, and was also addressed in macOS Tahoe 26.1. The vulnerability was disclosed on November 3, 2025, and was discovered by Gergely Kalman (@gergely_kalman). It carries a CVSS v3.1 base score of 5.5 (Medium) (Apple Sequoia Advisory, Apple Sonoma Advisory, Apple Tahoe Advisory).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22), specifically a parsing flaw in how macOS CoreServices handles directory path strings. An attacker with low-privileged local access can exploit this flaw to bypass path validation logic and access sensitive user data outside of normally permitted directories. The attack vector is local, requires low privileges, and no user interaction. Apple addressed the issue with improved path validation in the affected components (Apple Sequoia Advisory, Apple Sonoma Advisory).

Successful exploitation allows a low-privileged local application or attacker to read sensitive user data that should be protected by macOS access controls. The confidentiality impact is rated High, while integrity and availability are unaffected. There is no evidence of lateral movement capability or remote exploitation, but unauthorized access to sensitive user files (e.g., credentials, personal data) could facilitate further attacks (Apple Sequoia Advisory, Apple Sonoma Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.021% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

Apple has released patches addressing this vulnerability in macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1 (released November 3, 2025). Users should update to these versions immediately via System Settings > Software Update. No configuration-based workaround is available; upgrading is the only remediation. Restricting local user privileges and monitoring for unauthorized file access can serve as compensating controls until patching is possible (Apple Sequoia Advisory, Apple Sonoma Advisory, Apple Tahoe Advisory).

The vulnerability was noted in the SANS Internet Storm Center diary covering the November 2025 Apple security updates, which highlighted the broad scope of fixes in the release. The CIS also published an advisory covering multiple vulnerabilities in Apple products from this update cycle. No significant independent researcher commentary or social media discussion specific to CVE-2025-43382 has been identified beyond standard patch reporting (SANS ISC, CIS Advisory).