CVE-2025-46310: 
macOS vulnerability analysis and mitigation

CVE-2025-46310 is a privilege management vulnerability in the macOS PackageKit component that allows an attacker with root privileges to delete protected system files. It was disclosed by Apple on February 11, 2026, and affects macOS Sonoma 14.x before 14.8.4 and macOS Sequoia 15.x before 15.7.4. The vulnerability was discovered and reported by Mickey Jin (@patch1t). It carries a CVSS v3.1 base score of 6.0 (Medium) (Apple Sonoma Advisory, Apple Sequoia Advisory).

The vulnerability is classified as CWE-269 (Improper Privilege Management) and resides in the PackageKit framework on macOS, which handles software installation and package management. The root cause is improper state management within PackageKit that fails to adequately restrict file deletion operations even for protected system files when invoked by a root-privileged process. Exploitation requires local access and root-level privileges, meaning an attacker must have already achieved root access before leveraging this flaw to bypass macOS system file protections (such as System Integrity Protection-adjacent restrictions). Apple addressed the issue through improved state management (Apple Sonoma Advisory, Apple Sequoia Advisory).

Successful exploitation allows an attacker who already holds root privileges to delete protected system files that would otherwise be shielded by macOS security mechanisms. This can result in high integrity and availability impact — critical OS components or security-relevant files could be removed, potentially destabilizing or permanently damaging the system. Confidentiality is not directly impacted by this vulnerability. The attack vector is local and requires no user interaction, but the prerequisite of root access limits the immediate attack surface (Apple Sonoma Advisory, Apple Sequoia Advisory).

Apple has released patches addressing CVE-2025-46310 in macOS Sonoma 14.8.4 and macOS Sequoia 15.7.4, both released on February 11, 2026. The vulnerability was also addressed in macOS Tahoe 26 (released September 15, 2025, with the PackageKit fix noted as added May 26, 2026). Users should update to the latest available macOS version immediately. No configuration-based workarounds have been published by Apple (Apple Sonoma Advisory, Apple Sequoia Advisory, macOS Tahoe Advisory).

The vulnerability was credited to Mickey Jin (@patch1t), a prolific macOS security researcher known for discovering numerous Apple platform vulnerabilities. No significant public commentary, media coverage, or notable community discussion specific to CVE-2025-46310 has been identified beyond its inclusion in Apple's security advisories (Apple Sonoma Advisory).