CVE-2025-43518: 
macOS vulnerability analysis and mitigation

CVE-2025-43518 is a logic issue in Apple's Foundation framework that allows a locally installed app to inappropriately access files through the spellcheck API. The vulnerability was discovered by Noah Gregory (wts.dev) and disclosed on December 12, 2025, when Apple released patches across multiple platforms. Affected software includes macOS Sonoma prior to 14.8.3, macOS Sequoia prior to 15.7.3, iOS and iPadOS prior to 26.2, macOS Tahoe prior to 26.2, and watchOS prior to 26.2. It carries a CVSS v3.1 base score of 3.3 (Low), assessed by CISA-ADP (Apple Advisory iOS 26.2, Apple Advisory macOS Sequoia, Apple Advisory macOS Sonoma).

The vulnerability is rooted in a logic flaw (CWE-284: Improper Access Control) within Apple's Foundation framework, specifically in how the spellcheck API handles file access. Insufficient validation checks allowed an app to leverage the spellcheck API as an unintended pathway to read files outside its normally permitted scope. Exploitation requires local access and low privileges — an attacker-controlled app running on the device can trigger the issue without any user interaction. The researcher Noah Gregory published a technical write-up at wts.dev describing the vulnerability, referred to as "DirtyDict" (wts.dev write-up, Apple Advisory macOS Sequoia).

Successful exploitation results in a limited confidentiality impact, allowing a malicious app to read files it should not have access to via the spellcheck API. There is no integrity or availability impact — the vulnerability does not enable file modification, code execution, or denial of service. The scope is constrained to the local device and the files accessible through the spellcheck API pathway, limiting the risk of lateral movement or broad data exfiltration (Apple Advisory macOS Sonoma, Apple Advisory iOS 26.2).

1. Develop or obtain a malicious app: Create an app that runs locally on a target Apple device (macOS, iOS, iPadOS, or watchOS) with standard low-privilege user access.
2. Invoke the spellcheck API: Use the Foundation framework's spellcheck API in a way that exploits the logic flaw, crafting API calls that reference file paths outside the app's sandbox or permitted scope.
3. Access restricted files: Due to insufficient access control checks in the Foundation framework, the API returns content from files the app would not normally be permitted to read.
4. Exfiltrate data: Read and transmit the accessed file contents to an attacker-controlled destination (wts.dev write-up, Apple Advisory macOS Sequoia).

• Logs: Unusual file access events in system logs (e.g., unified system log via log show) involving the Foundation spellcheck subsystem accessing paths outside an app's expected sandbox container.
• File System: Unexpected read access to sensitive files (e.g., user documents, configuration files) by apps that have no legitimate reason to access them, detectable via file access auditing tools such as fs_usage or endpoint security frameworks.
• Process: Apps making anomalous or high-frequency calls to spellcheck-related Foundation APIs while simultaneously accessing file paths unrelated to text input (wts.dev write-up).

Apple has released patches addressing this vulnerability across all affected platforms: macOS Sonoma 14.8.3, macOS Sequoia 15.7.3, iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2, and watchOS 26.2. Users and administrators should update to these versions or later as soon as possible. No configuration-based workarounds have been published by Apple; updating to a patched release is the only recommended remediation (Apple Advisory macOS Sequoia, Apple Advisory macOS Sonoma, Apple Advisory iOS 26.2).

The vulnerability was discovered and reported by security researcher Noah Gregory (wts.dev), who published a technical write-up titled "DirtyDict" detailing the issue. The disclosure was part of Apple's December 12, 2025 security update cycle, which also addressed more severe vulnerabilities including actively exploited WebKit flaws, drawing broader media attention to the update batch. Coverage of CVE-2025-43518 specifically was limited given its low severity rating (wts.dev write-up, Apple Advisory iOS 26.2).