Description
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
Published: 2025-12-12
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure
Action: Apply Patch
AI Analysis

Impact

A logic flaw in Apple macOS Tahoe permits an application to read sensitive user data it should not access, compromising data confidentiality. The vulnerability is classified as a logic failure (CWE‑497).

Affected Systems

Apple macOS (macOS Tahoe) versions prior to 26.1 are affected. The bug was fixed in the 26.1 release and later updates.

Risk and Exploitability

The CVSS score of 5.5 indicates medium severity, while an EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but an attacker could potentially abuse the logic error through a locally running or signed application to gain unauthorized data access.

Generated by OpenCVE AI on April 22, 2026 at 20:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the macOS 26.1 update or later, which contains the fix for the logic flaw.
  • Remove or restrict the permissions of any applications that had elevated access to sensitive data before the update.
  • Enable macOS security features such as Gatekeeper and App Sandbox to limit unauthorized application data access.

Generated by OpenCVE AI on April 22, 2026 at 20:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://support.apple.com/en-us/125634 cve-icon cve-icon
History

Wed, 22 Apr 2026 21:00:00 +0000

Type Values Removed Values Added
Title Logic Issue Allowing App Access to Sensitive User Data in macOS Tahoe

Tue, 16 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-497
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 15 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Sun, 14 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Fri, 12 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Description A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:26:19.869Z

Reserved: 2025-04-16T15:24:37.120Z

Link: CVE-2025-43406

cve-icon Vulnrichment

Updated: 2025-12-16T21:31:50.127Z

cve-icon NVD

Status : Modified

Published: 2025-12-12T21:15:54.010

Modified: 2025-12-16T22:15:46.987

Link: CVE-2025-43406

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T20:45:27Z

Weaknesses