CVE-2025-43298

Directory Path Parsing Vulnerability Allowing Privilege Escalation in macOS

Published Sep 15, 2025 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privileges.

Analysis

Technical impact

A parsing issue in the handling of directory paths was reported. The flaw allows an application to craft a path that bypasses normal validation, leading to unauthorized elevation of privileges to the root level. The weakness is a pathname traversal flaw (CWE‑41) that can compromise system integrity if exploited.

Affected Systems

The flaw affects Apple macOS builds prior to the fixes released in macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26. Any installations older than these versions should be considered vulnerable.

Risk and Exploitability

The reported CVSS score is 7.8, indicating a high‑severity vulnerability, while the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. Based on the description, the likely attack vector is local, where a trusted or user‑initiated application can supply a crafted path to trigger the failure in path validation and gain root privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 14.8
`0`	affected	< 15.7
`0`	affected	< 26

Configuration 1 [-]

OR	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

Vendor	Product	Versions
Apple	Macos	—
Apple	Macos Sequoia	—
Apple	Macos Sonoma	—
Apple	Macos Tahoe	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to macOS Sequoia 15.7 or later, macOS Sonoma 14.8 or later, or macOS Tahoe 26 or later.
Enable Gatekeeper and App Sandbox to restrict third‑party applications from accessing privileged system directories without explicit permission.
Set up log monitoring to detect unexpected root‑level operations and review system logs for anomalous activity.

Generated by OpenCVE AI on April 27, 2026 at 23:49 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-29272	A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privileges.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.253% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Sep/53
http://seclists.org/fulldisclosure/2025/Sep/54
http://seclists.org/fulldisclosure/2025/Sep/55
https://support.apple.com/en-us/125110
https://support.apple.com/en-us/125111
https://support.apple.com/en-us/125112

History

Apr 28, 2026 12:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Directory Path Parsing Vulnerability Allowing Privilege Escalation in macOS

Apr 2, 2026 8:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sonoma 14.8, macOS Sequoia 15.7. An app may be able to gain root privileges.	A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privileges.
References		https://support.apple.com/en-us/125110

Nov 4, 2025 2:30 AM References updated View changes

Type	Values Removed	Values Added
References	https://support.apple.com/en-us/125110

Nov 4, 2025 1:45 AM Description updated View changes

Type	Values Removed	Values Added
Description	A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privileges.	A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sonoma 14.8, macOS Sequoia 15.7. An app may be able to gain root privileges.

Nov 3, 2025 7:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Sep/53 http://seclists.org/fulldisclosure/2025/Sep/54 http://seclists.org/fulldisclosure/2025/Sep/55

Sep 17, 2025 1:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:apple:macos::::::::

Sep 17, 2025 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Apple macos Sequoia Apple macos Sonoma Apple macos Tahoe
Vendors & Products		Apple Apple macos Apple macos Sequoia Apple macos Sonoma Apple macos Tahoe

Sep 16, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 16, 2025 3:00 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-41
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 15, 2025 10:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privileges.
References		https://support.apple.com/en-us/125110 https://support.apple.com/en-us/125111 https://support.apple.com/en-us/125112