CVE-2025-43204

macOS Sandbox Escape Vulnerability

View on CVE.org
Published Sep 15, 2025 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox.

Analysis

AI-generated

Technical impact

The vulnerability existed in macOS prior to the Tahoe 26 release and was addressed by removing the vulnerable code. Before the fix, an application could escape its sandbox, enabling it to access system resources beyond the intended boundaries. The flaw represents an Access Control weakness (CWE‑284). Apple resolved the issue by eliminating the code path that allowed this escape.

Affected Systems

The vulnerability impacts macOS installations that precede macOS Tahoe 26. All earlier releases, including every macOS version before Tahoe 26, are affected; the patch is delivered with macOS Tahoe 26 and later releases.

Risk and Exploitability

With a CVSS score of 7.8 the flaw is considered high severity, yet the EPSS score of < 1 % indicates a very low probability of exploitation at present. The likely attack vector is local via an application that could invoke the vulnerable code, though this is inferred from the description because the vector is not explicitly stated. The vulnerability is not listed in the CISA KEV catalog and no workaround is available, so upgrading remains mandatory.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade your macOS installation to macOS Tahoe 26 or a later release that includes the patch that removes the vulnerable code.
  • Avoid installing or executing applications that rely on the legacy component that was removed, as they may still try to use the vulnerable code path.
  • Stay informed about future security updates from Apple by regularly checking the support website and subscribing to security advisories.

Generated by OpenCVE AI on April 28, 2026 at 22:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-29314 This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox.
History
Type Values Removed Values Added
Title macOS Sandbox Escape Vulnerability
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox.
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Apr 2, 2026, 6:17 PM
Reserved
Apr 16, 2025, 3:24 PM

View source JSON

Updated
Nov 3, 2025, 6:09 PM

JSON

Status
Modified
Published
Sep 15, 2025, 11:15 PM
Modified
Jun 17, 2026, 9:23 AM

View source JSON

No data.

Updated
Apr 28, 2026, 10:45 PM

JSON