Description
This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to launch arbitrary binaries on a trusted device.
Published: 2025-07-29
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An improper input validation flaw in Apple macOS allows an attacker that can launch a malicious application to execute arbitrary binaries on a trusted device. The flaw permits the attacker to run any binary as the current user, resulting in full local code execution and compromising device integrity. The weakness is classified as CWE‑20 Input Validation.

Affected Systems

The vulnerability affects Apple macOS versions prior to macOS Sequoia 15.6 and macOS Sonoma 14.7.7. Any installation of Sequoia 15.0 through 15.5 or Sonoma 14.0 through 14.7.6 is at risk. The issue has been fixed in the released updates mentioned above.

Risk and Exploitability

With a CVSS score of 9.8, the risk is severe. The EPSS score of less than 1 % indicates a low likelihood of widespread exploitation at present, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is a malicious application executed locally on the device, exploiting the faulty input handling to launch arbitrary binaries.

Generated by OpenCVE AI on April 28, 2026 at 00:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest macOS updates that include the fix (Sequoia 15.6 or Sonoma 14.7.7).
  • Enforce Gatekeeper to allow only signed applications from the App Store or identified developers, preventing unsigned binaries from running.
  • Enable process auditing or MDM controls to monitor and block unexpected binary launches, and review system logs for unauthorized execution attempts.

Generated by OpenCVE AI on April 28, 2026 at 00:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-23116 This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to launch arbitrary binaries on a trusted device.
History

Tue, 28 Apr 2026 01:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Improper Input Validation Allows Launch of Arbitrary Binaries

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Thu, 31 Jul 2025 21:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Wed, 30 Jul 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Jul 2025 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Apple macos Sequoia
Apple macos Sonoma
Vendors & Products Apple
Apple macos
Apple macos Sequoia
Apple macos Sonoma

Tue, 29 Jul 2025 23:45:00 +0000

Type Values Removed Values Added
Description This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to launch arbitrary binaries on a trusted device.
References

Subscriptions

Apple Macos Macos Sequoia Macos Sonoma
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:17:04.919Z

Reserved: 2025-04-16T15:24:37.092Z

Link: CVE-2025-43253

cve-icon Vulnrichment

Updated: 2025-11-03T20:03:09.423Z

cve-icon NVD

Status : Modified

Published: 2025-07-30T00:15:37.167

Modified: 2025-11-03T20:18:57.620

Link: CVE-2025-43253

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T00:45:17Z

Weaknesses