CVE-2025-43187

Arbitrary Code Execution via hdiutil Command

Published Aug 29, 2025 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Running an hdiutil command may unexpectedly execute arbitrary code.

Analysis

Technical impact

The vulnerable macOS "hdiutil" command could be manipulated to run unintended shell commands, allowing an attacker to execute arbitrary code on the affected system. This operation bypasses normal security controls and grants an attacker full control over the affected machine. The weakness stems from improper handling of command‑line arguments and is consistent with a CWE‑78 style vulnerability.

Affected Systems

Apple macOS systems running a version earlier than Sequoia 15.6, Sonoma 14.7.7, or Ventura 13.7.7 are affected; the issue was resolved by removing the vulnerable code in the releases listed above.

Risk and Exploitability

The CVSS score of 7.8 indicates a high‑severity vulnerability, yet the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog and appears to require local execution of the hdiutil command, meaning the attacker must either obtain local access or manipulate a user trusted to run the command.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 13.7.7
`0`	affected	< 14.7.7
`0`	affected	< 15.6

Configuration 1 [-]

OR	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

Vendor	Product	Versions
Apple	Macos	—
Apple	Macos Sequoia	—
Apple	Macos Sonoma	—
Apple	Macos Ventura	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest macOS update—Sequoia 15.6 or newer, Sonoma 14.7.7 or newer, or Ventura 13.7.7 or newer—to remove the vulnerable code.
If an update cannot be applied immediately, restrict or disable the hdiutil command for non‑trusted users and monitor for suspicious usage patterns.
Review any scripts or automated processes that invoke hdiutil to ensure they accept only trusted arguments and sources.

Generated by OpenCVE AI on April 28, 2026 at 18:42 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-26255	This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.7.7, macOS Ventura 13.7.7, macOS Sequoia 15.6. Running an hdiutil command may unexpectedly execute arbitrary code.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.240% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Jul/32
http://seclists.org/fulldisclosure/2025/Jul/33
http://seclists.org/fulldisclosure/2025/Jul/34
https://support.apple.com/en-us/124149
https://support.apple.com/en-us/124150
https://support.apple.com/en-us/124151

History

Apr 28, 2026 7:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Arbitrary Code Execution via hdiutil Command

Apr 2, 2026 8:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.7.7, macOS Ventura 13.7.7, macOS Sequoia 15.6. Running an hdiutil command may unexpectedly execute arbitrary code.	This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Running an hdiutil command may unexpectedly execute arbitrary code.

Nov 3, 2025 8:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Jul/32 http://seclists.org/fulldisclosure/2025/Jul/33 http://seclists.org/fulldisclosure/2025/Jul/34

Sep 2, 2025 1:00 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:apple:macos::::::::

Sep 1, 2025 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Apple macos Sequoia Apple macos Sonoma Apple macos Ventura
Vendors & Products		Apple Apple macos Apple macos Sequoia Apple macos Sonoma Apple macos Ventura

Aug 29, 2025 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 29, 2025 12:45 AM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.7.7, macOS Ventura 13.7.7, macOS Sequoia 15.6. Running an hdiutil command may unexpectedly execute arbitrary code.
References		https://support.apple.com/en-us/124149 https://support.apple.com/en-us/124150 https://support.apple.com/en-us/124151