CVE-2025-43403: 
macOS vulnerability analysis and mitigation

CVE-2025-43403 is an improper authorization vulnerability in the macOS Compression component that allows a malicious app to access sensitive user data. It was disclosed by Apple on February 11, 2026, and affects macOS Sonoma versions prior to 14.8.4 and macOS Sequoia versions prior to 15.7.4. The vulnerability was also addressed retroactively in macOS Tahoe 26. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with no privileges required but requiring user interaction (Apple Sequoia Advisory, Apple Sonoma Advisory).

The root cause is classified as CWE-285 (Improper Authorization), specifically an authorization issue in the macOS Compression subsystem stemming from inadequate state management. Apple's advisory describes the fix as addressing the issue "with improved state management," suggesting the vulnerability arose from a race condition or incorrect state tracking that allowed an app to bypass authorization checks and access data it should not be permitted to read. The attack vector is local, requiring a malicious app to be installed and run on the target system with user interaction, but no elevated privileges are needed. The vulnerability was discovered and reported by Mickey Jin (@patch1t) (Apple Sequoia Advisory, Apple Sonoma Advisory).

Successful exploitation allows a malicious application to access sensitive user data that it is not authorized to read, resulting in a high confidentiality impact with no integrity or availability impact. The scope is limited to the local system, and the vulnerability does not provide a path to privilege escalation or lateral movement on its own. The primary risk is unauthorized data exposure — for example, a sandboxed or otherwise restricted app gaining access to user files or protected data managed by the Compression framework (Apple Sonoma Advisory, Apple Sequoia Advisory).

Apple has released patches addressing this vulnerability in macOS Sonoma 14.8.4 and macOS Sequoia 15.7.4, both released on February 11, 2026. The vulnerability is also addressed in macOS Tahoe 26. Users should update their macOS installations to these versions or later via System Settings > Software Update. No configuration-based workarounds have been published by Apple (Apple Sequoia Advisory, Apple Sonoma Advisory, macOS Tahoe Advisory).