Description
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to read sensitive location information.
Published: 2025-12-12
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive location data disclosure
Action: Apply update
AI Analysis

Impact

The vulnerability is a permissions issue that was addressed by removing exploitable code. An application may be able to read sensitive location information without appropriate authorization, resulting in unauthorized disclosure of location data. The weakness is classified as CWE‑284.

Affected Systems

The flaw impacts Apple macOS releases before the patch level. It is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2; all earlier releases of these macOS variants are potentially affected.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% reflects a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or user‑initiated, as an app can read location data once executed. No network‑based exploitation is suggested.

Generated by OpenCVE AI on April 28, 2026 at 10:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade macOS to the latest patched releases (Sequoia 15.7.3, Sonoma 14.8.3, Tahoe 26.2).
  • Restrict application permissions to limit which apps can access location data.
  • Disable location services for non‑essential applications or enforce restrictions via a configuration profile.

Generated by OpenCVE AI on April 28, 2026 at 10:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 10:45:00 +0000

Type Values Removed Values Added
Title Local Application May Read Sensitive Location Data Due to Permissions Flaw

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3. An app may be able to read sensitive location information. A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to read sensitive location information.

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.8.3, macOS Sequoia 15.7.3. An app may be able to read sensitive location information. A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3. An app may be able to read sensitive location information.
References

Tue, 16 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 16 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Tue, 16 Dec 2025 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Sun, 14 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Apple macos Sequoia
Apple macos Sonoma
Vendors & Products Apple
Apple macos
Apple macos Sequoia
Apple macos Sonoma

Fri, 12 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.8.3, macOS Sequoia 15.7.3. An app may be able to read sensitive location information.
References

Subscriptions

Apple Macos Macos Sequoia Macos Sonoma
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:17:42.777Z

Reserved: 2025-04-16T15:27:21.196Z

Link: CVE-2025-43513

cve-icon Vulnrichment

Updated: 2025-12-16T16:35:23.201Z

cve-icon NVD

Status : Modified

Published: 2025-12-12T21:15:56.227

Modified: 2026-04-02T19:20:57.913

Link: CVE-2025-43513

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T10:30:29Z

Weaknesses