macOS Sonoma 14.8 Security Update

What macOS Sonoma 14.8 Fixes

macOS Sonoma 14.8, released September 15, 2025, fixes 47 vulnerabilities in 38 parts of the system, according to Apple's security advisory.

Apple does not say that any of them were exploited before the fix. That makes macOS Sonoma 14.8 a routine security update: worth installing soon, not an emergency.

It has since been superseded: the newest security release for macOS Sonoma is macOS Sonoma 14.8.9, from August 6, 2026, which includes these fixes.

Grouped by us from the impact Apple gives for each fix; the impact lines below are Apple's own.

Which Devices Get macOS Sonoma 14.8

Apple lists macOS Sonoma 14.8 for: macOS Sonoma.

How to Install macOS Sonoma 14.8

On the Mac, open System Settings → General → Software Update. Macs that cannot run the newest macOS are offered the update for their own version there.

Security fixes are cumulative: any later release for the same version includes these as well, so if you are already past macOS Sonoma 14.8 there is nothing to do.

Every Fix in macOS Sonoma 14.8

All 47 CVEs in Apple's advisory, the most serious kinds first. Each entry is the part of the system affected, Apple's description of the impact and the fix, and the CVE ID.

• CoreMedia

  A sandboxed process may be able to circumvent sandbox restrictions

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-43273

• NetFSFramework

  An app may be able to break out of its sandbox

  A race condition was addressed with additional validation.

  CVE-2025-43364

• PackageKit

  An app may be able to gain root privileges

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43298

• Security Initialization

  An app may be able to break out of its sandbox

  A file quarantine bypass was addressed with additional checks.

  CVE-2025-43332

• SharedFileList

  An app may be able to break out of its sandbox

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43286

• Shortcuts

  A shortcut may be able to bypass sandbox restrictions

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-43358

• Storage

  An app may be able to gain root privileges

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43341

• StorageKit

  An app may be able to gain root privileges

  A race condition was addressed with improved state handling.

  CVE-2025-43304

• StorageKit

  A malicious app may be able to gain root privileges

  A logic issue was addressed with improved checks.

  CVE-2025-43306

• AppKit

  An app may be able to access protected user data

  The issue was resolved by blocking unsigned services from launching on Intel Macs.

  CVE-2025-43321

• Apple Online Store Kit

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-31268

• AppSandbox

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43285

• CoreServices

  A malicious app may be able to access private information

  A logic issue was addressed with improved checks.

  CVE-2025-43305

• CoreServices

  A malicious app may be able to access sensitive user data

  A logic issue was addressed with improved validation.

  CVE-2025-43289

• FaceTime

  Incoming FaceTime calls can appear or be accepted on a locked macOS device, even with notifications disabled on the lock screen

  This issue was addressed through improved state management.

  CVE-2025-31271

• GPU Drivers

  An app may be able to access sensitive user data

  An out-of-bounds read was addressed with improved bounds checking.

  CVE-2025-43326

• IOKit

  An app may be able to access sensitive user data

  An authorization issue was addressed with improved state management.

  CVE-2025-31255

• Kernel

  An app may be able to access sensitive user data

  A correctness issue was addressed with improved checks.

  CVE-2025-43345

• LaunchServices

  An app may be able to access user-sensitive data

  A logic issue was addressed with improved checks.

  CVE-2025-43231

• MediaLibrary

  An app may be able to access protected user data

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43319

• MigrationKit

  An app may be able to access user-sensitive data

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43315

• Phone

  An app may be able to access sensitive user data

  A logging issue was addressed with improved data redaction.

  CVE-2025-43508

• Printing

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-31269

• SharedFileList

  An app may be able to access sensitive user data

  The issue was addressed with improved input validation.

  CVE-2025-43293

• Siri

  An app may be able to access protected user data

  A privacy issue was addressed by moving sensitive data.

  CVE-2025-43367

• Spell Check

  An app may be able to access sensitive user data

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43190

• Spotlight

  An app may be able to access sensitive user data

  A logic issue was addressed with improved checks.

  CVE-2025-24197

• StorageKit

  An app may be able to access sensitive user data

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43314

• Touch Bar

  An app may be able to access protected user data

  This issue was addressed with additional entitlement checks.

  CVE-2025-43311

• Touch Bar Controls

  An app may be able to access sensitive user data

  This issue was addressed with additional entitlement checks.

  CVE-2025-43308

• WindowServer

  An app may be able to trick a user into copying sensitive data to the pasteboard

  A configuration issue was addressed with additional restrictions.

  CVE-2025-43310

• AMD

  An app may be able to cause unexpected system termination

  A buffer overflow was addressed with improved bounds checking.

  CVE-2025-43312

• CoreAudio

  Processing a maliciously crafted video file may lead to unexpected app termination

  An out-of-bounds write issue was addressed with improved input validation.

  CVE-2025-43349

• CoreAudio

  Processing a maliciously crafted audio file may lead to memory corruption

  The issue was addressed with improved memory handling.

  CVE-2025-43277

• IOHIDFamily

  An app may be able to cause unexpected system termination

  An out-of-bounds write issue was addressed with improved bounds checking.

  CVE-2025-43302

• libc

  An app may be able to cause a denial-of-service

  A denial-of-service issue was addressed with improved validation.

  CVE-2025-43299 CVE-2025-43295

• Libinfo

  Processing a maliciously crafted string may lead to heap corruption

  The issue was addressed with improved bounds checks.

  CVE-2025-43353

• MobileStorageMounter

  An app may be able to cause a denial-of-service

  A type confusion issue was addressed with improved memory handling.

  CVE-2025-43355

• Ruby

  Processing a file may lead to a denial-of-service or potentially disclose memory contents

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2024-27280

• Call History

  An app may be able to fingerprint the user

  This issue was addressed with improved redaction of sensitive information.

  CVE-2025-43357

• CoreServices

  An app may be able to modify protected parts of the file system

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43290

• Kernel

  A UDP server socket bound to a local interface may become bound to all interfaces

  A logic issue was addressed with improved state management.

  CVE-2025-43359

• Notification Center

  An app may be able to access contact info related to notifications in Notification Center

  A privacy issue was addressed with improved private data redaction for log entries.

  CVE-2025-43301

• Perl

  Multiple issues in Perl

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2025-40909

• Screenshots

  An app may be able to capture a screenshot of an app entering or exiting full screen mode

  A privacy issue was addressed with improved checks.

  CVE-2025-31259

• SharedFileList

  An app may be able to modify protected parts of the file system

  A permissions issue was addressed by removing the vulnerable code.

  CVE-2025-43291

macOS Sonoma Security Release History

macOS Sonoma 14.8 in context: the security releases Apple has published for macOS Sonoma, newest first, with the number of fixes each carried.

The Same Fixes Elsewhere

Apple ships most fixes to every platform that shares the code, and to older versions still under support. These releases close at least one of the same CVEs:

Frequently Asked Questions