CVE-2025-43404: 
macOS vulnerability analysis and mitigation

CVE-2025-43404 is a permissions/sandbox issue in Apple macOS that allows a locally-installed app to access sensitive user data. The vulnerability was discovered and disclosed by Zhongquan Li (@Guluisacat) and fixed in macOS Tahoe 26.1, released November 3, 2025. It affects all macOS Tahoe versions prior to 26.1. The CVSS v3.1 base score is 3.3 (Low), reflecting its local attack vector and limited confidentiality impact (Apple Advisory, NVD).

The root cause is classified as CWE-284 (Improper Access Control), specifically a permissions issue within the macOS Sandbox component. Apple addressed the flaw by applying additional sandbox restrictions, indicating that the sandbox profile for one or more apps did not sufficiently restrict access to sensitive user data paths or resources. Exploitation requires a locally-running app with low privileges and no user interaction, suggesting the flaw may allow a sandboxed app to read data outside its designated sandbox boundary. No public technical write-up or proof-of-concept code has been identified (Apple Advisory, NVD).

Successful exploitation allows a malicious or compromised app to read sensitive user data that should be protected by macOS sandbox restrictions. The impact is limited to confidentiality — there is no integrity or availability impact. The scope is confined to the local system, and there is no evidence of potential for lateral movement or remote exploitation (Apple Advisory, NVD).

Apple has released a fix in macOS Tahoe 26.1 (released November 3, 2025), which addresses the issue with additional sandbox restrictions. Users and administrators should update all affected macOS Tahoe systems to version 26.1 or later. No configuration-based workaround has been published by Apple. The vulnerability is detectable via Qualys scanner (detection ID 385860) (Apple Advisory).

The vulnerability was noted in the SANS Internet Storm Center diary covering the macOS Tahoe 26.1 release and was included in a CIS advisory on multiple Apple vulnerabilities. Community reaction has been minimal given the low severity score. No notable researcher commentary or significant media coverage specific to this CVE has been identified (SANS ISC, CIS Advisory).