CVE-2025-43390: 
macOS vulnerability analysis and mitigation

CVE-2025-43390 is a code-signing verification downgrade vulnerability in the AppleMobileFileIntegrity component of macOS, affecting Intel-based Mac computers. A malicious app may exploit this flaw to bypass security restrictions and access user-sensitive data. The vulnerability was disclosed on November 3, 2025, and is fixed in macOS Sequoia 15.7.2 and macOS Tahoe 26.1. It carries a CVSS v3.1 base score of 5.5 (Medium) (Apple, Apple).

The vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature) and stems from insufficient code-signing enforcement in the AppleMobileFileIntegrity subsystem on Intel-based Macs. An attacker can craft or leverage a malicious local application that exploits a downgrade condition — forcing the system to accept weaker or bypassed code-signing checks — to gain unauthorized access to protected user data. Exploitation requires local access and user interaction (e.g., running the malicious app), with no privileges required. The fix involved adding additional code-signing restrictions to prevent the downgrade (Apple, Apple). The vulnerability was discovered and reported by Mickey Jin (@patch1t).

Successful exploitation allows a malicious local application to access user-sensitive data that would otherwise be protected by macOS security controls, resulting in a high confidentiality impact. Integrity and availability are not affected. The scope is limited to the local system, and the vulnerability does not provide a direct path to privilege escalation or lateral movement, but unauthorized data access could expose credentials, personal files, or other sensitive information stored on the affected Mac (Apple).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction, which further limits the practical attack surface (Apple).

Apple has released patches addressing this vulnerability in macOS Sequoia 15.7.2 (released November 3, 2025) and macOS Tahoe 26.1. Users running macOS on Intel-based Mac computers should update to one of these versions immediately via System Settings > Software Update. As interim measures, users should avoid running untrusted or unknown applications, implement application whitelisting, and monitor for suspicious local application activity (Apple, Apple).

The CIS Security advisory noted this vulnerability as part of a broader set of Apple product vulnerabilities that could allow for arbitrary code execution and data access, recommending prompt patching. The SANS Internet Storm Center also covered the November 2025 Apple security updates in a diary entry. No significant independent researcher commentary or social media discussion specific to CVE-2025-43390 has been identified beyond standard vulnerability tracking.