CVE-2025-43358 addresses a permissions issue in Apple iOS, iPadOS, and macOS where a shortcut could bypass sandbox restrictions, categorized as CWE-862 (Missing Authorization). This vulnerability has been resolved in iOS 18.7/26, iPadOS 18.7/26, and macOS Sequoia 15.7, Sonoma 14.8, and Tahoe 26. It carries a CVSSv3.1 score of 8.8 (High), indicating a local attack vector with low complexity and low privileges required, potentially leading to high impact on confidentiality, integrity, and availability through a sandbox escape. There is currently no evidence of active exploitation, nor is there publicly available exploit code or significant community discussion, and it is not listed on CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 18.7CPE matchmatch criteria | cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | ||
< 18.7CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | ||
>= 14.0, < 14.8CPE matchmatch criteria | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | ||
>= 15.0, < 15.7CPE matchmatch criteria | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.