# Sequoia 15.7.2 Sequoia 15.7.2, released November 3, 2025, fixes 57 CVEs in Sequoia. 2 of them are being exploited (CVE-2025-43520); 2 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/macos/sequoia-15.7.2 - Platform: macOS - Released: Nov 3, 2025 - Priority: Patch now (Closes CVE-2025-43520, exploited (CISA KEV)) - CVEs: 57, exploited: 2, on CISA KEV: 2 - Vendor advisory: https://support.apple.com/en-us/125635 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Sequoia](https://patchblox.com/security/data/product/macos/sequoia.md) | | 15.7.2 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-43520](https://patchblox.com/security/data/cve/CVE-2025-43520.md) | Patch now | Kernel: A malicious application may be able to cause unexpected system termination or write kernel memory | 5.5 | 0.0043 | CISA KEV | | [CVE-2025-43510](https://patchblox.com/security/data/cve/CVE-2025-43510.md) | Patch now | Kernel: A malicious application may cause unexpected changes in memory shared between processes | 7.8 | 0.0036 | CISA KEV | | [CVE-2025-30465](https://patchblox.com/security/data/cve/CVE-2025-30465.md) | Urgent | Shortcuts: A shortcut may be able to access files that are normally inaccessible to the Shortcuts app | 9.8 | 0.0107 | | | [CVE-2024-49761](https://patchblox.com/security/data/cve/CVE-2024-49761.md) | High | Ruby: Multiple issues in ruby | 7.5 | 0.0142 | | | [CVE-2025-43401](https://patchblox.com/security/data/cve/CVE-2025-43401.md) | High | CoreAnimation: A remote attacker may be able to cause a denial-of-service | 7.5 | 0.0103 | | | [CVE-2025-43413](https://patchblox.com/security/data/cve/CVE-2025-43413.md) | High | libxpc: A sandboxed app may be able to observe system-wide network connections | 7.5 | 0.0063 | | | [CVE-2025-43399](https://patchblox.com/security/data/cve/CVE-2025-43399.md) | High | Siri: An app may be able to access protected user data | 7.5 | 0.0059 | | | [CVE-2025-43405](https://patchblox.com/security/data/cve/CVE-2025-43405.md) | High | Photos: An app may be able to access user-sensitive data | 7.5 | 0.0059 | | | [CVE-2025-43494](https://patchblox.com/security/data/cve/CVE-2025-43494.md) | High | Mail: An attacker may be able to cause a persistent denial-of-service | 7.5 | 0.0057 | | | [CVE-2025-43496](https://patchblox.com/security/data/cve/CVE-2025-43496.md) | High | Mail Drafts: Remote content may be loaded even when the 'Load Remote Images' setting is turned off | 7.5 | 0.0052 | | | [CVE-2025-43373](https://patchblox.com/security/data/cve/CVE-2025-43373.md) | High | Wi-Fi: An app may be able to cause unexpected system termination or corrupt kernel memory | 7.5 | 0.0049 | | | [CVE-2025-43361](https://patchblox.com/security/data/cve/CVE-2025-43361.md) | High | Audio: A malicious app may be able to read kernel memory | 7.8 | 0.0021 | | | [CVE-2025-43476](https://patchblox.com/security/data/cve/CVE-2025-43476.md) | High | SharedFileList: An app may be able to break out of its sandbox | 7.8 | 0.0020 | | | [CVE-2025-43407](https://patchblox.com/security/data/cve/CVE-2025-43407.md) | High | Assets: An app may be able to break out of its sandbox | 7.8 | 0.0020 | | | [CVE-2025-43472](https://patchblox.com/security/data/cve/CVE-2025-43472.md) | High | zsh: An app may be able to gain root privileges | 7.8 | 0.0020 | | | [CVE-2025-43474](https://patchblox.com/security/data/cve/CVE-2025-43474.md) | High | GPU Drivers: An app may be able to cause unexpected system termination or read kernel memory | 7.8 | 0.0020 | | | [CVE-2025-43387](https://patchblox.com/security/data/cve/CVE-2025-43387.md) | High | DiskArbitration: A malicious app may be able to gain root privileges | 7.8 | 0.0017 | | | [CVE-2024-43398](https://patchblox.com/security/data/cve/CVE-2024-43398.md) | Routine | Ruby: Multiple issues in ruby | 5.9 | 0.0121 | | | [CVE-2025-43445](https://patchblox.com/security/data/cve/CVE-2025-43445.md) | Routine | CoreText: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 4.3 | 0.0112 | | | [CVE-2025-43383](https://patchblox.com/security/data/cve/CVE-2025-43383.md) | Routine | Model I/O: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 4.3 | 0.0100 | | | [CVE-2025-6442](https://patchblox.com/security/data/cve/CVE-2025-6442.md) | Routine | Ruby: Multiple issues in ruby | 6.5 | 0.0050 | | | [CVE-2025-43448](https://patchblox.com/security/data/cve/CVE-2025-43448.md) | Routine | CloudKit: An app may be able to break out of its sandbox | 6.3 | 0.0032 | | | [CVE-2025-43408](https://patchblox.com/security/data/cve/CVE-2025-43408.md) | Routine | Share Sheet: An attacker with physical access may be able to access contacts from the lock screen | 2.4 | 0.0026 | | | [CVE-2025-43394](https://patchblox.com/security/data/cve/CVE-2025-43394.md) | Routine | bootp: An app may be able to access protected user data | 5.5 | 0.0025 | | | [CVE-2025-43423](https://patchblox.com/security/data/cve/CVE-2025-43423.md) | Routine | Audio: An attacker with physical access to an unlocked device paired with a Mac may be able to view sensitive user information in system logging | 2.0 | 0.0025 | | | [CVE-2025-43410](https://patchblox.com/security/data/cve/CVE-2025-43410.md) | Routine | Notes: An attacker with physical access may be able to view deleted notes | 2.4 | 0.0025 | | | [CVE-2025-43348](https://patchblox.com/security/data/cve/CVE-2025-43348.md) | Routine | Finder: An app may bypass Gatekeeper checks | 5.5 | 0.0024 | | | [CVE-2025-43446](https://patchblox.com/security/data/cve/CVE-2025-43446.md) | Routine | Assets: An app may be able to modify protected parts of the file system | 5.5 | 0.0023 | | | [CVE-2025-43395](https://patchblox.com/security/data/cve/CVE-2025-43395.md) | Routine | configd: An app may be able to access protected user data | 3.3 | 0.0022 | | | [CVE-2025-43382](https://patchblox.com/security/data/cve/CVE-2025-43382.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43379](https://patchblox.com/security/data/cve/CVE-2025-43379.md) | Routine | AppleMobileFileIntegrity: An app may be able to access protected user data | 5.5 | 0.0021 | | | [CVE-2025-43322](https://patchblox.com/security/data/cve/CVE-2025-43322.md) | Routine | Admin Framework: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43334](https://patchblox.com/security/data/cve/CVE-2025-43334.md) | Routine | sudo: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43335](https://patchblox.com/security/data/cve/CVE-2025-43335.md) | Routine | Security: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43411](https://patchblox.com/security/data/cve/CVE-2025-43411.md) | Routine | PackageKit: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43479](https://patchblox.com/security/data/cve/CVE-2025-43479.md) | Routine | CoreServices: An app may be able to access sensitive user data | 5.5 | 0.0021 | | | [CVE-2025-43391](https://patchblox.com/security/data/cve/CVE-2025-43391.md) | Routine | Photos: An app may be able to access sensitive user data | 5.5 | 0.0021 | | | [CVE-2025-43409](https://patchblox.com/security/data/cve/CVE-2025-43409.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43336](https://patchblox.com/security/data/cve/CVE-2025-43336.md) | Routine | SoftwareUpdate: An app with root privileges may be able to access private information | 4.4 | 0.0020 | | | [CVE-2025-43398](https://patchblox.com/security/data/cve/CVE-2025-43398.md) | Routine | Kernel: An app may be able to cause unexpected system termination | 5.5 | 0.0020 | | | [CVE-2025-43380](https://patchblox.com/security/data/cve/CVE-2025-43380.md) | Routine | sips: Parsing a file may lead to an unexpected app termination | 5.5 | 0.0020 | | | [CVE-2025-43396](https://patchblox.com/security/data/cve/CVE-2025-43396.md) | Routine | Installer: A sandboxed app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43477](https://patchblox.com/security/data/cve/CVE-2025-43477.md) | Routine | Siri: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43498](https://patchblox.com/security/data/cve/CVE-2025-43498.md) | Routine | FileProvider: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43389](https://patchblox.com/security/data/cve/CVE-2025-43389.md) | Routine | Notes: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43377](https://patchblox.com/security/data/cve/CVE-2025-43377.md) | Routine | Model I/O: An app may be able to cause a denial-of-service | 5.5 | 0.0019 | | | [CVE-2025-43337](https://patchblox.com/security/data/cve/CVE-2025-43337.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43499](https://patchblox.com/security/data/cve/CVE-2025-43499.md) | Routine | Shortcuts: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43469](https://patchblox.com/security/data/cve/CVE-2025-43469.md) | Routine | NSSpellChecker: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43397](https://patchblox.com/security/data/cve/CVE-2025-43397.md) | Routine | SoftwareUpdate: An app may be able to cause a denial-of-service | 5.5 | 0.0018 | | | [CVE-2025-43478](https://patchblox.com/security/data/cve/CVE-2025-43478.md) | Routine | ASP TCP: An app may be able to cause unexpected system termination | 5.5 | 0.0018 | | | [CVE-2025-43412](https://patchblox.com/security/data/cve/CVE-2025-43412.md) | Routine | TCC: An app may be able to break out of its sandbox | 6.3 | 0.0018 | | | [CVE-2025-43292](https://patchblox.com/security/data/cve/CVE-2025-43292.md) | Routine | CoreMedia: An app may be able to access sensitive user data | 5.5 | 0.0017 | | | [CVE-2025-43481](https://patchblox.com/security/data/cve/CVE-2025-43481.md) | Routine | Disk Images: An app may be able to break out of its sandbox | 5.2 | 0.0016 | | | [CVE-2025-43390](https://patchblox.com/security/data/cve/CVE-2025-43390.md) | Routine | AppleMobileFileIntegrity: An app may be able to access user-sensitive data | 5.5 | 0.0014 | | | [CVE-2025-43420](https://patchblox.com/security/data/cve/CVE-2025-43420.md) | Routine | Dock: An app may be able to access sensitive user data | 4.7 | 0.0014 | | | [CVE-2025-43468](https://patchblox.com/security/data/cve/CVE-2025-43468.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0013 | | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.