# Sequoia 15.6 Sequoia 15.6, released July 29, 2025, fixes 85 CVEs in Sequoia. One of them is being exploited (CVE-2025-6558); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/macos/sequoia-15.6 - Platform: macOS - Released: Jul 29, 2025 - Priority: Patch now (Closes CVE-2025-6558, exploited (CISA KEV)) - CVEs: 85, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://support.apple.com/en-us/124149 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Sequoia](https://patchblox.com/security/data/product/macos/sequoia.md) | | 15.6 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-6558](https://patchblox.com/security/data/cve/CVE-2025-6558.md) | Patch now | Chromium: CVE-2025-6558 Incorrect validation of untrusted input in ANGLE and GPU | 8.8 | 0.1093 | CISA KEV | | [CVE-2025-31281](https://patchblox.com/security/data/cve/CVE-2025-31281.md) | Urgent | Model I/O: Processing a maliciously crafted file may lead to unexpected app termination | 9.1 | 0.0128 | | | [CVE-2025-43186](https://patchblox.com/security/data/cve/CVE-2025-43186.md) | Urgent | afclip: Parsing a file may lead to an unexpected app termination | 9.8 | 0.0127 | | | [CVE-2025-43234](https://patchblox.com/security/data/cve/CVE-2025-43234.md) | Urgent | Metal: Processing a maliciously crafted texture may lead to unexpected app termination | 9.8 | 0.0105 | | | [CVE-2025-31279](https://patchblox.com/security/data/cve/CVE-2025-31279.md) | Urgent | Find My: An app may be able to fingerprint the user | 9.8 | 0.0102 | | | [CVE-2025-43209](https://patchblox.com/security/data/cve/CVE-2025-43209.md) | Urgent | ICU: Processing maliciously crafted web content may lead to an unexpected Safari crash | 9.8 | 0.0100 | | | [CVE-2025-43220](https://patchblox.com/security/data/cve/CVE-2025-43220.md) | Urgent | copyfile: An app may be able to access protected user data | 9.8 | 0.0089 | | | [CVE-2025-43261](https://patchblox.com/security/data/cve/CVE-2025-43261.md) | Urgent | File Bookmark: An app may be able to break out of its sandbox | 9.8 | 0.0083 | | | [CVE-2025-43222](https://patchblox.com/security/data/cve/CVE-2025-43222.md) | Urgent | CFNetwork: An attacker may be able to cause unexpected app termination | 9.8 | 0.0080 | | | [CVE-2025-43193](https://patchblox.com/security/data/cve/CVE-2025-43193.md) | Urgent | SecurityAgent: An app may be able to cause a denial-of-service | 9.8 | 0.0080 | | | [CVE-2025-43189](https://patchblox.com/security/data/cve/CVE-2025-43189.md) | Urgent | WebContentFilter: A malicious app may be able to read kernel memory | 9.8 | 0.0079 | | | [CVE-2025-43194](https://patchblox.com/security/data/cve/CVE-2025-43194.md) | Urgent | PackageKit: An app may be able to modify protected parts of the file system | 9.8 | 0.0079 | | | [CVE-2025-43199](https://patchblox.com/security/data/cve/CVE-2025-43199.md) | Urgent | Core Services: A malicious app may be able to gain root privileges | 9.8 | 0.0079 | | | [CVE-2025-43253](https://patchblox.com/security/data/cve/CVE-2025-43253.md) | Urgent | AppleMobileFileIntegrity: A malicious app may be able to launch arbitrary binaries on a trusted device | 9.8 | 0.0078 | | | [CVE-2025-43232](https://patchblox.com/security/data/cve/CVE-2025-43232.md) | Urgent | PackageKit: An app may be able to bypass certain Privacy preferences | 9.8 | 0.0078 | | | [CVE-2025-43233](https://patchblox.com/security/data/cve/CVE-2025-43233.md) | Urgent | Security: A malicious app acting as a HTTPS proxy could get access to sensitive user data | 9.8 | 0.0077 | | | [CVE-2025-43243](https://patchblox.com/security/data/cve/CVE-2025-43243.md) | Urgent | Software Update: An app may be able to modify protected parts of the file system | 9.8 | 0.0077 | | | [CVE-2025-43245](https://patchblox.com/security/data/cve/CVE-2025-43245.md) | Urgent | AppleMobileFileIntegrity: An app may be able to access protected user data | 9.8 | 0.0074 | | | [CVE-2025-43192](https://patchblox.com/security/data/cve/CVE-2025-43192.md) | Urgent | Managed Configuration: Account-driven User Enrollment may still be possible with Lockdown Mode turned on | 9.8 | 0.0068 | | | [CVE-2025-43273](https://patchblox.com/security/data/cve/CVE-2025-43273.md) | Urgent | CoreMedia: A sandboxed process may be able to circumvent sandbox restrictions | 9.1 | 0.0067 | | | [CVE-2025-43198](https://patchblox.com/security/data/cve/CVE-2025-43198.md) | Urgent | Dock: An app may be able to access protected user data | 9.8 | 0.0066 | | | [CVE-2025-43275](https://patchblox.com/security/data/cve/CVE-2025-43275.md) | Urgent | NetAuth: An app may be able to break out of its sandbox | 9.8 | 0.0063 | | | [CVE-2025-43244](https://patchblox.com/security/data/cve/CVE-2025-43244.md) | Urgent | AMD: An app may be able to cause unexpected system termination | 9.8 | 0.0060 | | | [CVE-2025-43237](https://patchblox.com/security/data/cve/CVE-2025-43237.md) | Urgent | WebContentFilter: An app may be able to cause unexpected system termination | 9.8 | 0.0056 | | | [CVE-2025-6965](https://patchblox.com/security/data/cve/CVE-2025-6965.md) | High | SQLite: Processing a file may lead to memory corruption | 7.7 | 0.7345 | | | [CVE-2025-7424](https://patchblox.com/security/data/cve/CVE-2025-7424.md) | High | Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes | 7.5 | 0.0130 | | | [CVE-2025-43227](https://patchblox.com/security/data/cve/CVE-2025-43227.md) | High | WebKit: Processing maliciously crafted web content may disclose sensitive user information | 8.8 | 0.0125 | | | [CVE-2025-31278](https://patchblox.com/security/data/cve/CVE-2025-31278.md) | High | WebKit: Processing maliciously crafted web content may lead to memory corruption | 8.8 | 0.0124 | | | [CVE-2025-43216](https://patchblox.com/security/data/cve/CVE-2025-43216.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash | 8.8 | 0.0111 | | | [CVE-2025-43214](https://patchblox.com/security/data/cve/CVE-2025-43214.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash | 8.8 | 0.0109 | | | [CVE-2025-43223](https://patchblox.com/security/data/cve/CVE-2025-43223.md) | High | CFNetwork: A non-privileged user may be able to modify restricted network settings | 7.5 | 0.0102 | | | [CVE-2025-43240](https://patchblox.com/security/data/cve/CVE-2025-43240.md) | High | WebKit: A download's origin may be incorrectly associated | 8.8 | 0.0101 | | | [CVE-2025-7425](https://patchblox.com/security/data/cve/CVE-2025-7425.md) | High | Libxslt: heap use-after-free in libxslt caused by atype corruption in xmlattrptr | 7.8 | 0.0044 | | | [CVE-2025-43202](https://patchblox.com/security/data/cve/CVE-2025-43202.md) | High | libnetcore: Processing a file may lead to memory corruption | 8.8 | 0.0043 | | | [CVE-2025-43211](https://patchblox.com/security/data/cve/CVE-2025-43211.md) | High | WebKit: Processing web content may lead to a denial-of-service | 8.8 | 0.0042 | | | [CVE-2025-43264](https://patchblox.com/security/data/cve/CVE-2025-43264.md) | High | Model I/O: Processing a maliciously crafted image may corrupt process memory | 8.8 | 0.0041 | | | [CVE-2025-43265](https://patchblox.com/security/data/cve/CVE-2025-43265.md) | High | WebKit: Processing maliciously crafted web content may disclose internal states of the app | 8.8 | 0.0034 | | | [CVE-2025-31280](https://patchblox.com/security/data/cve/CVE-2025-31280.md) | High | Model I/O: Processing a maliciously crafted file may lead to heap corruption | 7.8 | 0.0032 | | | [CVE-2025-43277](https://patchblox.com/security/data/cve/CVE-2025-43277.md) | High | CoreAudio: Processing a maliciously crafted audio file may lead to memory corruption | 7.8 | 0.0031 | | | [CVE-2025-43224](https://patchblox.com/security/data/cve/CVE-2025-43224.md) | High | Model I/O: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 7.1 | 0.0030 | | | [CVE-2025-43196](https://patchblox.com/security/data/cve/CVE-2025-43196.md) | High | libxpc: An app may be able to gain root privileges | 7.8 | 0.0026 | | | [CVE-2025-43239](https://patchblox.com/security/data/cve/CVE-2025-43239.md) | High | sips: Processing a maliciously crafted file may lead to unexpected app termination | 7.1 | 0.0025 | | | [CVE-2025-43187](https://patchblox.com/security/data/cve/CVE-2025-43187.md) | High | Disk Images: Running an hdiutil command may unexpectedly execute arbitrary code | 7.8 | 0.0024 | | | [CVE-2025-43188](https://patchblox.com/security/data/cve/CVE-2025-43188.md) | High | DiskArbitration: A malicious app may be able to gain root privileges | 7.8 | 0.0023 | | | [CVE-2025-43248](https://patchblox.com/security/data/cve/CVE-2025-43248.md) | High | AppleMobileFileIntegrity: A malicious app may be able to gain root privileges | 7.8 | 0.0023 | | | [CVE-2025-43249](https://patchblox.com/security/data/cve/CVE-2025-43249.md) | High | AppleMobileFileIntegrity: An app may be able to gain root privileges | 7.8 | 0.0023 | | | [CVE-2025-43270](https://patchblox.com/security/data/cve/CVE-2025-43270.md) | High | Notes: An app may gain unauthorized access to Local Network | 8.8 | 0.0023 | | | [CVE-2025-43254](https://patchblox.com/security/data/cve/CVE-2025-43254.md) | High | file: Processing a maliciously crafted file may lead to unexpected app termination | 7.1 | 0.0023 | | | [CVE-2025-31243](https://patchblox.com/security/data/cve/CVE-2025-31243.md) | High | AppleMobileFileIntegrity: An app may be able to gain root privileges | 7.8 | 0.0022 | | | [CVE-2025-43256](https://patchblox.com/security/data/cve/CVE-2025-43256.md) | High | StorageKit: An app may be able to gain root privileges | 7.8 | 0.0022 | | | [CVE-2025-43257](https://patchblox.com/security/data/cve/CVE-2025-43257.md) | High | Archive Utility: An app may be able to break out of its sandbox | 8.7 | 0.0018 | | | [CVE-2025-43268](https://patchblox.com/security/data/cve/CVE-2025-43268.md) | High | Kernel: A malicious app may be able to gain root privileges | 7.8 | 0.0017 | | | [CVE-2025-43281](https://patchblox.com/security/data/cve/CVE-2025-43281.md) | High | Application Firewall: A local attacker may be able to elevate their privileges | 7.8 | 0.0015 | | | [CVE-2025-24188](https://patchblox.com/security/data/cve/CVE-2025-24188.md) | Routine | Safari: Processing maliciously crafted web content may lead to an unexpected Safari crash | 6.5 | 0.0060 | | | [CVE-2025-43247](https://patchblox.com/security/data/cve/CVE-2025-43247.md) | Routine | PackageKit: A malicious app with root privileges may be able to modify the contents of system files | 5.5 | 0.0053 | | | [CVE-2025-43252](https://patchblox.com/security/data/cve/CVE-2025-43252.md) | Routine | zip: A website may be able to access sensitive user data when resolving symlinks | 6.5 | 0.0053 | | | [CVE-2025-43210](https://patchblox.com/security/data/cve/CVE-2025-43210.md) | Routine | CoreMedia: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 6.3 | 0.0040 | | | [CVE-2025-43276](https://patchblox.com/security/data/cve/CVE-2025-43276.md) | Routine | Kernel: iCloud Private Relay may not activate when more than one user is logged in at the same time | 5.3 | 0.0040 | | | [CVE-2025-43229](https://patchblox.com/security/data/cve/CVE-2025-43229.md) | Routine | WebKit: Processing maliciously crafted web content may lead to universal cross site scripting | 6.1 | 0.0035 | | | [CVE-2025-43259](https://patchblox.com/security/data/cve/CVE-2025-43259.md) | Routine | WindowServer: An attacker with physical access to a locked device may be able to view sensitive user information | 4.6 | 0.0030 | | | [CVE-2025-43267](https://patchblox.com/security/data/cve/CVE-2025-43267.md) | Routine | Directory Utility: An app may be able to access sensitive user data | 5.5 | 0.0026 | | | [CVE-2025-43191](https://patchblox.com/security/data/cve/CVE-2025-43191.md) | Routine | Admin Framework: An app may be able to cause a denial-of-service | 6.2 | 0.0026 | | | [CVE-2025-43215](https://patchblox.com/security/data/cve/CVE-2025-43215.md) | Routine | Model I/O: Processing a maliciously crafted image may result in disclosure of process memory | 5.5 | 0.0025 | | | [CVE-2025-43250](https://patchblox.com/security/data/cve/CVE-2025-43250.md) | Routine | SharedFileList: An app may be able to break out of its sandbox | 4.0 | 0.0025 | | | [CVE-2025-43226](https://patchblox.com/security/data/cve/CVE-2025-43226.md) | Routine | ImageIO: Processing a maliciously crafted image may result in disclosure of process memory | 4.0 | 0.0025 | | | [CVE-2025-43206](https://patchblox.com/security/data/cve/CVE-2025-43206.md) | Routine | System Settings: An app may be able to access protected user data | 4.0 | 0.0025 | | | [CVE-2025-43218](https://patchblox.com/security/data/cve/CVE-2025-43218.md) | Routine | Model I/O: Processing a maliciously crafted USD file may disclose memory contents | 5.5 | 0.0024 | | | [CVE-2025-43230](https://patchblox.com/security/data/cve/CVE-2025-43230.md) | Routine | CoreMedia Playback: An app may be able to access user-sensitive data | 4.0 | 0.0022 | | | [CVE-2025-43260](https://patchblox.com/security/data/cve/CVE-2025-43260.md) | Routine | PackageKit: An app may be able to hijack entitlements granted to other privileged apps | 5.1 | 0.0022 | | | [CVE-2025-43266](https://patchblox.com/security/data/cve/CVE-2025-43266.md) | Routine | NSSpellChecker: An app may be able to break out of its sandbox | 5.1 | 0.0022 | | | [CVE-2025-43195](https://patchblox.com/security/data/cve/CVE-2025-43195.md) | Routine | CoreServices: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43225](https://patchblox.com/security/data/cve/CVE-2025-43225.md) | Routine | Notes: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43246](https://patchblox.com/security/data/cve/CVE-2025-43246.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43241](https://patchblox.com/security/data/cve/CVE-2025-43241.md) | Routine | SceneKit: An app may be able to read files outside of its sandbox | 5.5 | 0.0021 | | | [CVE-2025-31275](https://patchblox.com/security/data/cve/CVE-2025-31275.md) | Routine | MediaRemote: A sandboxed process may be able to launch any installed app | 6.2 | 0.0021 | | | [CVE-2025-43255](https://patchblox.com/security/data/cve/CVE-2025-43255.md) | Routine | GPU Drivers: An app may be able to cause unexpected system termination | 3.3 | 0.0021 | | | [CVE-2025-43197](https://patchblox.com/security/data/cve/CVE-2025-43197.md) | Routine | Single Sign-On: An app may be able to access sensitive user data | 4.0 | 0.0021 | | | [CVE-2025-43238](https://patchblox.com/security/data/cve/CVE-2025-43238.md) | Routine | Xsan: An app may be able to cause unexpected system termination | 6.2 | 0.0020 | | | [CVE-2025-43235](https://patchblox.com/security/data/cve/CVE-2025-43235.md) | Routine | Power Management: An app may be able to cause a denial-of-service | 5.5 | 0.0020 | | | [CVE-2025-43236](https://patchblox.com/security/data/cve/CVE-2025-43236.md) | Routine | Power Management: An attacker may be able to cause unexpected app termination | 3.3 | 0.0018 | | | [CVE-2025-43251](https://patchblox.com/security/data/cve/CVE-2025-43251.md) | Routine | User Management: A local attacker may gain access to Keychain items | 5.5 | 0.0017 | | | [CVE-2025-43185](https://patchblox.com/security/data/cve/CVE-2025-43185.md) | Routine | Voice Control: An app may be able to access protected user data | 5.5 | 0.0016 | | | [CVE-2025-43282](https://patchblox.com/security/data/cve/CVE-2025-43282.md) | Routine | Kernel: An app may be able to cause unexpected system termination | 5.5 | 0.0016 | | | [CVE-2025-43313](https://patchblox.com/security/data/cve/CVE-2025-43313.md) | Routine | CoreServices: An app may be able to access sensitive user data | 5.5 | 0.0015 | | | [CVE-2025-43274](https://patchblox.com/security/data/cve/CVE-2025-43274.md) | Routine | RemoteViewServices: A sandboxed process may be able to circumvent sandbox restrictions | 4.4 | 0.0014 | | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.