Description
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
Published: 2025-09-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure
Action: Patch Update
AI Analysis

Impact

The vulnerability is an access issue tied to insufficient sandbox restrictions that could allow a malicious or misconfigured application to read or manipulate sensitive user data. This weakness is categorized as Access Control (CWE-284) and is rated with a CVSS score of 5.5, indicating moderate risk to data confidentiality.

Affected Systems

It affects Apple macOS Tahoe 26 and any earlier versions running unpatched. The fix is included in macOS Tahoe 26, so systems on that OS or older are vulnerable.

Risk and Exploitability

The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, implying a low likelihood of exploitation. However, because the issue involves bypassing sandbox controls, a local attacker or a user with the ability to run applications could potentially exploit it to access sensitive information. The risk is higher in environments where personal data is stored or processed.

Generated by OpenCVE AI on April 27, 2026 at 23:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade macOS to version Tahoe 26 or later to apply the corrected sandbox restrictions.
  • Remove any unnecessary third‑party applications that may have granted excess sandbox permissions.
  • Regularly apply Apple security updates to ensure all future patches are received promptly.

Generated by OpenCVE AI on April 27, 2026 at 23:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-29290 An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
History

Tue, 28 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Title macOS Tahoe Sandbox Access Issue That May Leak Sensitive User Data

Mon, 03 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 17 Sep 2025 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Wed, 17 Sep 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Tue, 16 Sep 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 15 Sep 2025 22:45:00 +0000

Type Values Removed Values Added
Description An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:22:43.903Z

Reserved: 2025-04-16T15:24:37.108Z

Link: CVE-2025-43325

cve-icon Vulnrichment

Updated: 2025-11-03T18:11:15.565Z

cve-icon NVD

Status : Modified

Published: 2025-09-15T23:15:35.173

Modified: 2025-11-03T19:16:00.730

Link: CVE-2025-43325

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T00:00:18Z

Weaknesses