CVE-2025-43253: Input Validation
Published Jul 29, 2025
·Updated
Admin Framework. A path handling issue was addressed with improved validation.
Credit
Ryan Dowd@@_rdowd, Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), ABC Research s.r.o., Mickey Jin@@patch1t, Noah Gregory (wts.dev), Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), an anonymous researcher, Gergely Kalman@@gergely_kalman, 风沐云烟@@binary_fmyy, Minghao Lin@@Y1nKoc, 2ourc3 | Salim Largo, Dawuge(Shuffle Team), Anonymous(Trend Micro Zero Day Initiative), Gary Kwong(Trend Micro Zero Day Initiative), CVE-2025-43226, Christian Kohlschütter, Ivan Fratric(Google Project Zero), Pyrophoria, Csaba Fitzl@@theevilbit(Kandji), Minghao Lin, Jiaxun Zhu, Kirin@@Pwnrin, Zhongquan Li@@Guluisacat, Koh M. Nakagawa@@tsunek0h(Kandji), Wojciech Regula(SecuRing), Yuebin Sun@@yuebinsun2020, Shang-De Jiang(CyCraft Technology), Kazma Ye(CyCraft Technology), Nikolai Skliarenko(Trend Micro Zero Day Initiative), Mickey Jin@@patch1t(Team Orca of Sea Security), Keith Yeo@@kyeojy(Team Orca of Sea Security), Martti Hütt, MRHAX, Aditya Rana, Google's Threat Analysis Group, Seo Hyun-gyu@@wh1te4ever(Xiaomi), Dora Orak(Xiaomi), Minghao Lin@@Y1nKoc(Xiaomi), XiLong Zhang@@Resery4(Xiaomi), noir@@ROIS, fmyy (@风沐云烟), Chi Yuan Chang(ZUSO ART), taikosoup, Willey Lin, Arsenii Kostromin (0x3c3e), Brian Carpenter, Sergei Glazunov(Google Project Zero), Dora Orak, Vlad Stolyarov(Google's Threat Analysis Group), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), an anonymous researcher(Loadshine Lab), Hikerell(Loadshine Lab), @@zlluny, CVE-2025-6965, Martin Bajanik(Fingerprint), Ammar Askar, Gilad Moav, Yehuda Afek, Anat Bremler-Barr, Amit Klein, Yuhao Hu, Yan Kang, Chenggang Wu, Xiaojie Wei, Syarif Muhammad Sajjad, shandikri(Trend Micro Zero Day Initiative), Google V8 Security Team, Nan Wang@@eternalsakura13, Ziling Chen, HexRabbit@@h3xr4bb1t(DEVCORE Research Team), Ignacio Sanmillan@@ulexec, Clément Lecigne(Google's Threat Analysis Group), Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft)
Affected Software
4 affected componentsFixes available
Apple macOS Sequoia<15.6
15.6
Apple macOS Sonoma<14.7.7
14.7.7
Apple macOS<14.7.7
Apple macOS>=15.0<15.6
Event History
Jul 29, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
CVE Published
via MITRE·11:35 PM
Data Sourced
via MITRE·11:35 PM
DescriptionWeakness
Jul 30, 2025
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-43253?
CVE-2025-43253 has a high severity rating due to the potential for unauthorized access and system integrity issues.
2
How do I fix CVE-2025-43253?
To fix CVE-2025-43253, update your system to at least macOS 14.7.8 or 15.6.
3
What are the affected versions for CVE-2025-43253?
CVE-2025-43253 affects macOS versions up to 14.7.7 and 15.6, including all prior versions.
4
What does CVE-2025-43253 address?
CVE-2025-43253 addresses a path handling issue, a permissions issue, and a race condition with improved validation and handling.
5
Who is the vendor for CVE-2025-43253?
The vendor for CVE-2025-43253 is Apple, specifically related to their macOS products.