CVE-2025-43465: Path Traversal
Published Mar 31, 2025
·Updated
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
Other sources
AccountPolicy. This issue was addressed by removing the vulnerable code.
— Apple
Admin Framework. A logic issue was addressed with improved checks.
— Apple
Admin Framework. The issue was addressed with improved checks.
— Apple
AirDrop. A permissions issue was addressed with additional restrictions.
— Apple
AirPlay. A null pointer dereference was addressed with improved input validation.
— Apple
Credit
Asaf Cohen, Ron Masas(BreakPoint), Pinak Oza, an anonymous researcher, Mickey Jin@@patch1t, Gergely Kalman@@gergely_kalman, Joseph Ravichandran@@0xjprx(MIT CSAIL), Dave G. (supernetworks.org), JZ, Zhongcheng Li(IES Red Team of ByteDance), Duy Trần@@khanhduytran0, Csaba Fitzl@@theevilbit(Kandji), Hikerell (Loadshine Lab), Wojciech Regula(SecuRing), Kirin@@Pwnrin(Fudan University), LFY@@secsys(Fudan University), 이동하 (Lee Dong Ha(BoB 14th), wac(Trend Micro Zero Day Initiative), Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Adwiteeya Agrawal, Kenneth Chew, Rodolphe Brunetti@@eisw0lf(Lupus Nova), Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), @@EthanArbuckle, pattern-f@@pattern_F_, iisBuri, Ferdous Saljooki@@malwarezoo(Jamf), Murray Mike, Cristian Dinca (icmd.tech), Apple, Dave G.(supernetworks), Alex Radocea(supernetworks), Taavi Eomäe(Zone Media), Romain Lebesle(Khatima), Himanshu Bharti@@Xpl0itme(Khatima), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), BynarIO AI (bynar.io), Google Threat Analysis Group, Doug Hogan, Kirin@@Pwnrin, KPC(Cisco Talos), CVE-2024-43398, CVE-2024-49761, CVE-2025-6442, @@RenwaX23, Zhongquan Li@@Guluisacat, Ryan Dowd@@_rdowd, Stanislav Jelezoglo, Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir, Nikolai Skliarenko(Trend Micro Zero Day Initiative), an anonymous researcher(Microsoft), Kirin@@Pwnrin(Microsoft), Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), Amy@@asentientbot, CVE-2025-32462, CVE-2025-53906, Aleksejs Popovs, Phil Beauvoir, Google Big Sleep, Gary Kwong, rheza@@ginggilBesel, Justin Cohen(Google), Nan Wang@@eternalsakura13, rheza@@ginggilBesel(Trend Micro Zero Day Initiative), shandikri(Trend Micro Zero Day Initiative), Gary Kwong(Trend Micro Zero Day Initiative), Tom Van Goethem, Wang Yu(Cyberserval), @@cloudlldb, Morris Richman@@morrisinlife, Uri Katz (Oligo Security), Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Bohdan Stasiuk@@bohdan_stasiuk, Yutong Xiu@@Sou1gh0st, Denis Tokarev@@illusionofcha0s, CVE-2025-24085, Nolan Astrein(Kandji), YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Minghao Lin@@Y1nKoc, Stephan Casas, CVE-2024-9681, Pietro Francesco Tirenna(Shielder), Davide Silvetti(Shielder), Abdel Adim Oisfi(Shielder), Manuel Fernandez (Stackhopper Security), Murray Mike(Trend Micro Zero Day Initiative), Anonymous(Trend Micro Zero Day Initiative), ABC Research s.r.o., Dave G.(Supernetworks), Michael (Biscuit) Thomas - @social.lol@@biscuit, Ian Beer(Google Project Zero), Paweł Płatek (Trail(Bits), CVE-2025-27113, CVE-2024-56171, 风沐云烟@@binary_fmyy(Supernetworks), Minghao Lin@@Y1nKoc(Supernetworks), Alex Radocea(Supernetworks), Diamant Osmani & Valdrin Haliti [Kosovë], dbpeppe, Solitechworld, Pwn2car, Mickey Jin@@patch1t(Kandji), (Kandji), Pedro Tôrres@@t0rr3sp3dr0, Noah Gregory (wts.dev), Arsenii Kostromin (0x3c3e), Bing Shi(Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Luyi Xing(Indiana University Bloomington), Halle Winkler, Politepix theoffcuts.org, Dolf Hoegaerts, Michiel Devliegere, Andrew James Gonzalez, Richard Hyunho Im with routezero.security@@richeeta, Dave G., zbleet(QI), Csaba Fitzl@@theevilbit(OffSec), 风沐云烟 (binary_fmyy)(DBAppSecurity's WeBin lab), Minghao Lin@@Y1nKoc(DBAppSecurity's WeBin lab), Pedro José Pereira Vieito / pvieito.com)@@pvieito, PixiePoint Security, Andreas Hegenberg (folivora.AI GmbH), Ron Masas(BREAKPOINT), Junsung <3(Trend Micro Zero Day Initiative)
Affected Software
4 affected componentsFixes available
Apple macOS<26.1
Apple macOS Tahoe<26.1
26.1
Apple macOS Sonoma<14.7.5
14.7.5
Apple macOS Ventura<13.7.5
13.7.5
Event History
Mar 31, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
Description
Updated
via Apple·12:00 AM
Affected Software
Updated
via Apple·12:00 AM
DescriptionAffected Software
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Nov 3, 2025
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Dec 12, 2025
CVE Published
via MITRE·08:56 PM
Data Sourced
via MITRE·08:56 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2025-43471
- CVE-2025-43322
- CVE-2025-46313
- CVE-2025-43455
- CVE-2025-43447
- CVE-2025-43462
- CVE-2025-43390
- CVE-2025-43388
- CVE-2025-43466
- CVE-2025-43382
- CVE-2025-43468
- CVE-2025-43379
- CVE-2025-43378
- CVE-2025-43478
- CVE-2025-43407
- CVE-2025-43446
- CVE-2025-43465
- CVE-2025-43423
- CVE-2025-43497
- CVE-2025-43394
- CVE-2025-43448
- CVE-2025-43395
- CVE-2025-43461
- CVE-2025-43426
- CVE-2025-43401
- CVE-2025-43479
- CVE-2025-43436
- CVE-2025-43381
- CVE-2025-43445
- CVE-2025-43481
- CVE-2025-43470
- CVE-2025-46315
- CVE-2025-43387
- CVE-2025-43420
- CVE-2025-43464
- CVE-2025-43498
- CVE-2025-43507
- CVE-2025-43348
- CVE-2025-43474
- CVE-2025-43396
- CVE-2025-43444
- CVE-2025-43467
- CVE-2025-43398
- CVE-2025-43510
- CVE-2025-43520
- CVE-2025-43413
- CVE-2025-43494
- CVE-2025-43496
- CVE-2025-43386
- CVE-2025-43385
- CVE-2025-43384
- CVE-2025-43383
- CVE-2025-43377
- CVE-2025-43424
- CVE-2025-43364
- CVE-2025-43506
- CVE-2025-43389
- CVE-2025-43469
- CVE-2025-43411
- CVE-2025-43508
- CVE-2025-43405
- CVE-2025-43391
- CVE-2025-43393
- CVE-2025-46316
- CVE-2024-43398
- CVE-2024-49761
- CVE-2025-6442
- CVE-2025-43493
- CVE-2025-43503
- CVE-2025-43502
- CVE-2025-43406
- CVE-2025-43404
- CVE-2025-43339
- CVE-2025-43500
- CVE-2025-43335
- CVE-2025-43408
- CVE-2025-43476
- CVE-2025-30465
- CVE-2025-43414
- CVE-2025-43473
- CVE-2025-43499
- CVE-2025-43380
- CVE-2025-43477
- CVE-2025-43399
- CVE-2025-43336
- CVE-2025-43397
- CVE-2025-43409
- CVE-2025-43351
- CVE-2025-43463
- CVE-2025-32462
- CVE-2025-43334
- CVE-2025-43412
- CVE-2025-53906
- CVE-2025-43480
- CVE-2025-43458
- CVE-2025-43430
- CVE-2025-43427
- CVE-2025-43443
- CVE-2025-43441
- CVE-2025-43435
- CVE-2025-43425
- CVE-2025-43440
- CVE-2025-43438
- CVE-2025-43457
- CVE-2025-43434
- CVE-2025-43433
- CVE-2025-43431
- CVE-2025-43432
- CVE-2025-43429
- CVE-2025-43421
- CVE-2025-43392
- CVE-2025-43373
- CVE-2025-43402
- CVE-2025-43472
- CVE-2025-24234
- CVE-2025-24097
- CVE-2025-24177
- CVE-2025-24179
- CVE-2025-24251
- CVE-2025-31197
- CVE-2025-24206
- CVE-2025-24126
- CVE-2025-24271
- CVE-2025-24270
- CVE-2025-24131
- CVE-2025-24129
- CVE-2025-30445
- CVE-2025-24252
- CVE-2025-24276
- CVE-2024-40864
- CVE-2025-24272
- CVE-2025-24231
- CVE-2025-24233
- CVE-2025-30443
- CVE-2025-43205
- CVE-2025-24243
- CVE-2025-24244
- CVE-2025-30460
- CVE-2025-24237
- CVE-2025-30429
- CVE-2025-24212
- CVE-2025-24215
- CVE-2025-24230
- CVE-2025-24085
- CVE-2025-24236
- CVE-2025-24190
- CVE-2025-24211
- CVE-2025-30454
- CVE-2025-31191
- CVE-2025-24170
- CVE-2025-31203
- CVE-2025-24277
- CVE-2024-9681
- CVE-2025-31189
- CVE-2025-24255
- CVE-2025-24267
- CVE-2025-30456
- CVE-2025-24111
- CVE-2025-30455
- CVE-2025-31187
- CVE-2025-30462
- CVE-2025-24199
- CVE-2025-30447
- CVE-2025-30431
- CVE-2025-24256
- CVE-2025-24273
- CVE-2025-30464
- CVE-2025-24210
- CVE-2025-24249
- CVE-2025-24229
- CVE-2025-24235
- CVE-2025-30432
- CVE-2025-24203
- CVE-2025-24196
- CVE-2025-24107
- CVE-2025-24148
- CVE-2025-24195
- CVE-2025-27113
- CVE-2024-56171
- CVE-2025-24178
- CVE-2025-31182
- CVE-2025-24238
- CVE-2025-31264
- CVE-2025-24172
- CVE-2025-30450
- CVE-2025-30470
- CVE-2025-24232
- CVE-2025-24246
- CVE-2025-24261
- CVE-2025-24164
- CVE-2025-30446
- CVE-2025-24259
- CVE-2025-30424
- CVE-2025-24173
- CVE-2025-30452
- CVE-2025-24181
- CVE-2025-30471
- CVE-2025-24250
- CVE-2025-30438
- CVE-2025-24280
- CVE-2025-31194
- CVE-2025-30433
- CVE-2025-24198
- CVE-2025-31183
- CVE-2025-24205
- CVE-2025-30444
- CVE-2025-24228
- CVE-2025-24165
- CVE-2025-24260
- CVE-2025-24254
- CVE-2024-54533
- CVE-2025-31261
- CVE-2025-24207
- CVE-2025-30449
- CVE-2025-24253
- CVE-2025-31188
- CVE-2025-24240
- CVE-2025-24278
- CVE-2025-30457
- CVE-2025-31195
- CVE-2025-24279
- CVE-2025-24247
- CVE-2025-24241
- CVE-2025-24266
- CVE-2025-24265
- CVE-2025-24157
- CVE-2025-31198
- CVE-2025-24139
Frequently Asked Questions
1
What is the severity of CVE-2025-43465?
CVE-2025-43465 has been rated as a high severity vulnerability.
2
What products are affected by CVE-2025-43465?
CVE-2025-43465 affects Apple macOS Tahoe up to version 26.1.
3
How do I fix CVE-2025-43465?
To fix CVE-2025-43465, update to the latest version of macOS Tahoe beyond 26.1.
4
What type of security issue is represented by CVE-2025-43465?
CVE-2025-43465 is a logic issue that was addressed with improved checks.
5
Does CVE-2025-43465 involve privacy concerns?
Yes, CVE-2025-43465 includes a privacy issue that was addressed with improved checks.