macOS Sequoia 15.7 Security Update

What macOS Sequoia 15.7 Fixes

macOS Sequoia 15.7, released September 15, 2025, fixes 46 vulnerabilities in 38 parts of the system, according to Apple's security advisory.

Apple does not say that any of them were exploited before the fix. That makes macOS Sequoia 15.7 a routine security update: worth installing soon, not an emergency.

It has since been superseded: the newest security release for macOS Sequoia is macOS Sequoia 15.8.2, from October 26, 2026, which includes these fixes.

Grouped by us from the impact Apple gives for each fix; the impact lines below are Apple's own.

Which Devices Get macOS Sequoia 15.7

Apple lists macOS Sequoia 15.7 for: macOS Sequoia.

How to Install macOS Sequoia 15.7

On the Mac, open System Settings → General → Software Update. Macs that cannot run the newest macOS are offered the update for their own version there.

Security fixes are cumulative: any later release for the same version includes these as well, so if you are already past macOS Sequoia 15.7 there is nothing to do.

Every Fix in macOS Sequoia 15.7

All 46 CVEs in Apple's advisory, the most serious kinds first. Each entry is the part of the system affected, Apple's description of the impact and the fix, and the CVE ID.

• ATS

  An app may be able to break out of its sandbox

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43330

• Crash Reporter

  An app may be able to gain root privileges

  A race condition was addressed with additional validation.

  CVE-2025-46284

• NetFSFramework

  An app may be able to break out of its sandbox

  A race condition was addressed with additional validation.

  CVE-2025-43364

• PackageKit

  An app may be able to gain root privileges

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43298

• Security Initialization

  An app may be able to break out of its sandbox

  A file quarantine bypass was addressed with additional checks.

  CVE-2025-43332

• SharedFileList

  An app may be able to break out of its sandbox

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43286

• Shortcuts

  A shortcut may be able to bypass sandbox restrictions

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-43358

• StorageKit

  An app may be able to gain root privileges

  A race condition was addressed with improved state handling.

  CVE-2025-43304

• StorageKit

  A malicious app may be able to gain root privileges

  A logic issue was addressed with improved checks.

  CVE-2025-43306

• AppKit

  An app may be able to access protected user data

  The issue was resolved by blocking unsigned services from launching on Intel Macs.

  CVE-2025-43321

• Apple Online Store Kit

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-31268

• AppSandbox

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43285

• Archive Utility

  An app may be able to bypass Privacy preferences

  This issue was addressed with improved validation of symlinks.

  CVE-2025-43288

• CoreMedia

  An app may be able to access sensitive user data

  A race condition was addressed with improved state handling.

  CVE-2025-43292

• CoreServices

  A malicious app may be able to access private information

  A logic issue was addressed with improved checks.

  CVE-2025-43305

• CoreServices

  A malicious app may be able to access sensitive user data

  A logic issue was addressed with improved validation.

  CVE-2025-43289

• FaceTime

  Incoming FaceTime calls can appear or be accepted on a locked macOS device, even with notifications disabled on the lock screen

  This issue was addressed through improved state management.

  CVE-2025-31271

• GPU Drivers

  An app may be able to access sensitive user data

  An out-of-bounds read was addressed with improved bounds checking.

  CVE-2025-43326

• IOKit

  An app may be able to access sensitive user data

  An authorization issue was addressed with improved state management.

  CVE-2025-31255

• Kernel

  An app may be able to access sensitive user data

  A correctness issue was addressed with improved checks.

  CVE-2025-43345

• MediaLibrary

  An app may be able to access protected user data

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43319

• MigrationKit

  An app may be able to access user-sensitive data

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43315

• Phone

  An app may be able to access sensitive user data

  A logging issue was addressed with improved data redaction.

  CVE-2025-43508

• SharedFileList

  An app may be able to access sensitive user data

  The issue was addressed with improved input validation.

  CVE-2025-43293

• Spell Check

  An app may be able to access sensitive user data

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43190

• Spotlight

  An app may be able to access sensitive user data

  A logic issue was addressed with improved checks.

  CVE-2025-24197

• StorageKit

  An app may be able to access sensitive user data

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43314

• Touch Bar

  An app may be able to access protected user data

  This issue was addressed with additional entitlement checks.

  CVE-2025-43311

• Touch Bar Controls

  An app may be able to access sensitive user data

  This issue was addressed with additional entitlement checks.

  CVE-2025-43308

• WindowServer

  An app may be able to trick a user into copying sensitive data to the pasteboard

  A configuration issue was addressed with additional restrictions.

  CVE-2025-43310

• AMD

  An app may be able to cause unexpected system termination

  A buffer overflow was addressed with improved bounds checking.

  CVE-2025-43312

• CoreAudio

  Processing a maliciously crafted video file may lead to unexpected app termination

  An out-of-bounds write issue was addressed with improved input validation.

  CVE-2025-43349

• dyld

  Visiting a website may lead to an app denial-of-service

  A denial-of-service issue was addressed with improved input validation.

  CVE-2025-43464

• IOHIDFamily

  An app may be able to cause unexpected system termination

  An out-of-bounds write issue was addressed with improved bounds checking.

  CVE-2025-43302

• libc

  An app may be able to cause a denial-of-service

  A denial-of-service issue was addressed with improved validation.

  CVE-2025-43299 CVE-2025-43295

• Libinfo

  Processing a maliciously crafted string may lead to heap corruption

  The issue was addressed with improved bounds checks.

  CVE-2025-43353

• MobileStorageMounter

  An app may be able to cause a denial-of-service

  A type confusion issue was addressed with improved memory handling.

  CVE-2025-43355

• Ruby

  Processing a file may lead to a denial-of-service or potentially disclose memory contents

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2024-27280

• Call History

  An app may be able to fingerprint the user

  This issue was addressed with improved redaction of sensitive information.

  CVE-2025-43357

• CoreServices

  An app may be able to modify protected parts of the file system

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43290

• Kernel

  A UDP server socket bound to a local interface may become bound to all interfaces

  A logic issue was addressed with improved state management.

  CVE-2025-43359

• Notification Center

  An app may be able to access contact info related to notifications in Notification Center

  A privacy issue was addressed with improved private data redaction for log entries.

  CVE-2025-43301

• Perl

  Multiple issues in Perl

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2025-40909

• Screenshots

  An app may be able to capture a screenshot of an app entering or exiting full screen mode

  A privacy issue was addressed with improved checks.

  CVE-2025-31259

• SharedFileList

  An app may be able to modify protected parts of the file system

  A permissions issue was addressed by removing the vulnerable code.

  CVE-2025-43291

macOS Sequoia Security Release History

macOS Sequoia 15.7 in context: the security releases Apple has published for macOS Sequoia, newest first, with the number of fixes each carried.

The Same Fixes Elsewhere

Apple ships most fixes to every platform that shares the code, and to older versions still under support. These releases close at least one of the same CVEs:

Frequently Asked Questions