CVE-2025-43337

macOS Sandbox Access Control Issue Allowing Sensitive Data Access

Published Sep 15, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26. An app may be able to access sensitive user data.

Analysis

Technical impact

The advisory states that an access issue was addressed by adding sandbox restrictions in macOS Sequoia 15.7.2 and macOS Tahoe 26. The issue could allow an application to read sensitive user data; the description indicates that this is an access control problem rather than a code execution flaw.

Affected Systems

Apple macOS users running versions older than Sequoia 15.7.2 or Tahoe 26 are potentially vulnerable. The vulnerability was fixed in those releases, so any installations before those versions may be affected.

Risk and Exploitability

The CVSS score of 5.5 classifies the risk as moderate. The EPSS score of less than 1% suggests a low probability of exploitation at this time. This vulnerability is not listed in the CISA KEV catalog. The advisory does not specify the attack vector; it only notes that sandbox restrictions were added. The context implies that the issue relates to applications running on the affected Mac, but the precise exploitation method is not detailed in the advisory.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 15.7.2
`0`	affected	< 26

Configuration 1 [-]

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Apple	Macos	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade macOS to at least Sequoia 15.7.2 or Tahoe 26, which contain the sandbox restriction fix. This is the official solution from Apple.
Restrict application permissions in System Settings › Privacy & Security to remove unnecessary access to sensitive data, reducing the attack surface.
Use Apple MDM or local Gatekeeper settings to enforce execution of only trusted applications and limit developer tool access on affected machines.

Generated by OpenCVE AI on April 28, 2026 at 18:41 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-29322	An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.188% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Sep/53
https://support.apple.com/en-us/125110
https://support.apple.com/en-us/125635

History

Apr 28, 2026 7:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		macOS Sandbox Access Control Issue Allowing Sensitive Data Access

Apr 2, 2026 8:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26, macOS Sequoia 15.7.2. An app may be able to access sensitive user data.	An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26. An app may be able to access sensitive user data.

Dec 17, 2025 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2. An app may be able to access sensitive user data.	An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26, macOS Sequoia 15.7.2. An app may be able to access sensitive user data.
References		https://support.apple.com/en-us/125110

Nov 4, 2025 2:30 AM References updated View changes

Type	Values Removed	Values Added
References	https://support.apple.com/en-us/125110

Nov 4, 2025 1:45 AM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.	An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2. An app may be able to access sensitive user data.
References		https://support.apple.com/en-us/125635

Nov 3, 2025 7:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Sep/53

Sep 17, 2025 2:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:apple:macos::::::::

Sep 17, 2025 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos
Vendors & Products		Apple Apple macos

Sep 16, 2025 6:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 15, 2025 10:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
References		https://support.apple.com/en-us/125110