CVE-2025-43278: macOS Sequoia Symlink Handling Vulnerability – Patch to 15.4

Technical summary

This vulnerability stems from inadequate validation of symbolic links (symlinks) in macOS Sequoia's file access control mechanisms. The flaw allows a malicious or compromised application to follow symlinks to locations containing protected user data, circumventing the sandbox or permission model that should prevent such access. The underlying weakness is classified as CWE-61 (Improper Link Resolution Before File Access), a well-known class of directory traversal and privilege escalation attacks. The fix implements stricter symlink resolution checks to ensure that applications cannot use symlink chains to escape intended access boundaries.

Business impact

For macOS-dependent organizations, this vulnerability poses a moderate risk to data confidentiality. Affected users could have sensitive files—such as browser credentials, SSH keys, application data, or encrypted backups—read by untrusted or compromised applications without their explicit awareness. The user interaction requirement limits mass automation, but targeted attacks or supply-chain compromises (malicious app updates) remain plausible. Organizations relying on macOS for handling regulated data (healthcare, finance, legal) should prioritize patching to maintain compliance and reduce insider-threat surface area.

Affected systems

macOS Sequoia versions prior to 15.4 are vulnerable. Systems running earlier macOS versions (Ventura, Sonoma) are not mentioned in this advisory and should be verified against Apple's security documentation. Organizations should inventory macOS Sequoia deployments, particularly those handling sensitive data or running third-party applications from less-trusted sources.

Exploitability

Exploitability is moderate. The attack requires local access to the system (AV:L) and user interaction (UI:R), such as the user launching or interacting with a malicious app. However, the barrier is not exceptionally high—a compromised or trojanized application could trigger the vulnerability silently. No network component is involved. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no active in-the-wild exploitation has been publicly disclosed as of the advisory date.

Remediation

Apple released macOS Sequoia 15.4 to address this issue. All users running earlier versions of Sequoia should update immediately. Organizations should enforce automatic updates where feasible or establish a phased rollout plan to minimize disruption. No workarounds are available; patching is the only remediation. Verify the installed version via System Preferences > General > About This Mac.

Patch guidance

1. Update to macOS Sequoia 15.4 or later via System Preferences > General > Software Update. 2. Enable automatic security updates to prevent similar issues from remaining unpatched. 3. For enterprise environments, use Mobile Device Management (MDM) or software deployment tools to enforce timely updates across your macOS fleet. 4. Document the update in your change management system and verify successful deployment before closing the ticket.

Detection guidance

Monitor system logs for suspicious symlink creation or resolution attempts, particularly in user-accessible directories (~/Library, ~/Documents). Security tools such as osquery or EDR solutions can log file-access events and symlink operations. Look for patterns where an application is following symlinks to protected directories. Additionally, review application behavior during and after updates to Sequoia 15.4 to ensure the fix is in place and symlink access is properly restricted.

Why prioritize this

This vulnerability should be prioritized as MEDIUM-to-HIGH for macOS Sequoia environments. The confidentiality impact is rated HIGH (reading protected user data), and the user interaction requirement is the primary control preventing widespread exploitation. Organizations with high-value user data, regulatory compliance obligations, or a history of supply-chain attacks should treat this as urgent. For general enterprise environments with standard macOS deployments, prioritize updates within your normal patching windows but do not delay indefinitely.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector, low complexity, no privilege requirements, user interaction, and high confidentiality impact with no integrity or availability impact. The score is conservative and appropriate for a localized data-access flaw. However, organizations handling sensitive personal, financial, or health data should internally score this higher based on their data sensitivity and risk tolerance.

Frequently asked questions