CVE-2025-46289

mediumpriority · track · 22EPSS 0.002 · 10 %ileDEEUNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.20% (10th) EPSS

CVSS 5.5 · medium

Is it mine?

14 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · scored 2026-10-22

A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access protected user data.

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nsecondaryexploitability 1.8 · impact 3.6

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-285US

affected products (14)

Products and version ranges known to be affected.

Apple macOS Sequoia <15.7.3all versionscert_bundDE
Apple macOS Sonoma <14.8.3all versionscert_bundDE
Apple macOS Tahoe <26.2all versionscert_bundDE
Apple macOS≤ Sequoia <15.7.3cert_bundDE
Apple macOS≤ Sonoma <14.8.3cert_bundDE
Apple macOS≤ Tahoe <26.2cert_bundDE
Apple macOS0 → 14.8.3enisa_euvdEU
Apple macOS0 → 15.7.3enisa_euvdEU
Apple macOS0 → 26.2enisa_euvdEU
Apple macOS Sequoia≤ vers:unknown/*ncsc_nlNL
Apple macOS Sonoma≤ vers:unknown/*ncsc_nlNL
Apple macOS Tahoe≤ vers:unknown/*ncsc_nlNL
apple macos14.0 → 14.8.3nvdUScpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
apple macos15.0 → 15.7.3nvdUScpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2025-0396Kwetsbaarheden verholpen in Apple macOSNL2025-12-15csaf · ncsc_nlNL
Apple heeft kwetsbaarheden verholpen in macOS Sonoma (14.8.3), macOS Sequoia (15.7.3) en macOS Tahoe (26.2).
WID-SEC-W-2025-2838Apple macOS: Mehrere SchwachstellenDeutsch2025-12-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund ncsc_nl nvd NVD CVE.org MITRE

published 2025-12-12modified 2026-06-17

references (9)

External citations — patches, advisories, analysis.

https://support.apple.com/en-us/125886 cnnvd
https://support.apple.com/en-us/125887 cnnvd
https://support.apple.com/en-us/125888 cnnvd
https://support.apple.com/en-us/125886 enisa_euvd
https://support.apple.com/en-us/125887 enisa_euvd
https://support.apple.com/en-us/125888 enisa_euvd
https://support.apple.com/en-us/125886Release NotesVendor Advisorynvd
https://support.apple.com/en-us/125887Release NotesVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan