# Sonoma 14.7.7 Sonoma 14.7.7, released July 29, 2025, fixes 51 CVEs in Sonoma. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/macos/sonoma-14.7.7 - Platform: macOS - Released: Jul 29, 2025 - Priority: Urgent (Closes CVE-2025-43186, rated Critical) - CVEs: 51, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://support.apple.com/en-us/124150 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Sonoma](https://patchblox.com/security/data/product/macos/sonoma.md) | | 14.7.7 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-43186](https://patchblox.com/security/data/cve/CVE-2025-43186.md) | Urgent | afclip: Parsing a file may lead to an unexpected app termination | 9.8 | 0.0127 | | | [CVE-2025-31279](https://patchblox.com/security/data/cve/CVE-2025-31279.md) | Urgent | Find My: An app may be able to fingerprint the user | 9.8 | 0.0102 | | | [CVE-2025-43209](https://patchblox.com/security/data/cve/CVE-2025-43209.md) | Urgent | ICU: Processing maliciously crafted web content may lead to an unexpected Safari crash | 9.8 | 0.0100 | | | [CVE-2025-43220](https://patchblox.com/security/data/cve/CVE-2025-43220.md) | Urgent | copyfile: An app may be able to access protected user data | 9.8 | 0.0089 | | | [CVE-2025-43261](https://patchblox.com/security/data/cve/CVE-2025-43261.md) | Urgent | File Bookmark: An app may be able to break out of its sandbox | 9.8 | 0.0083 | | | [CVE-2025-43184](https://patchblox.com/security/data/cve/CVE-2025-43184.md) | Urgent | Shortcuts: A shortcut may be able to bypass sensitive Shortcuts app settings | 9.8 | 0.0082 | | | [CVE-2025-43222](https://patchblox.com/security/data/cve/CVE-2025-43222.md) | Urgent | CFNetwork: An attacker may be able to cause unexpected app termination | 9.8 | 0.0080 | | | [CVE-2025-43193](https://patchblox.com/security/data/cve/CVE-2025-43193.md) | Urgent | SecurityAgent: An app may be able to cause a denial-of-service | 9.8 | 0.0080 | | | [CVE-2025-43189](https://patchblox.com/security/data/cve/CVE-2025-43189.md) | Urgent | WebContentFilter: A malicious app may be able to read kernel memory | 9.8 | 0.0079 | | | [CVE-2025-43194](https://patchblox.com/security/data/cve/CVE-2025-43194.md) | Urgent | PackageKit: An app may be able to modify protected parts of the file system | 9.8 | 0.0079 | | | [CVE-2025-43199](https://patchblox.com/security/data/cve/CVE-2025-43199.md) | Urgent | Core Services: A malicious app may be able to gain root privileges | 9.8 | 0.0079 | | | [CVE-2025-43253](https://patchblox.com/security/data/cve/CVE-2025-43253.md) | Urgent | AppleMobileFileIntegrity: A malicious app may be able to launch arbitrary binaries on a trusted device | 9.8 | 0.0078 | | | [CVE-2025-43232](https://patchblox.com/security/data/cve/CVE-2025-43232.md) | Urgent | PackageKit: An app may be able to bypass certain Privacy preferences | 9.8 | 0.0078 | | | [CVE-2025-43233](https://patchblox.com/security/data/cve/CVE-2025-43233.md) | Urgent | Security: A malicious app acting as a HTTPS proxy could get access to sensitive user data | 9.8 | 0.0077 | | | [CVE-2025-43243](https://patchblox.com/security/data/cve/CVE-2025-43243.md) | Urgent | Software Update: An app may be able to modify protected parts of the file system | 9.8 | 0.0077 | | | [CVE-2025-43245](https://patchblox.com/security/data/cve/CVE-2025-43245.md) | Urgent | AppleMobileFileIntegrity: An app may be able to access protected user data | 9.8 | 0.0074 | | | [CVE-2025-43192](https://patchblox.com/security/data/cve/CVE-2025-43192.md) | Urgent | Managed Configuration: Account-driven User Enrollment may still be possible with Lockdown Mode turned on | 9.8 | 0.0068 | | | [CVE-2025-43198](https://patchblox.com/security/data/cve/CVE-2025-43198.md) | Urgent | Dock: An app may be able to access protected user data | 9.8 | 0.0066 | | | [CVE-2025-43275](https://patchblox.com/security/data/cve/CVE-2025-43275.md) | Urgent | NetAuth: An app may be able to break out of its sandbox | 9.8 | 0.0063 | | | [CVE-2025-43244](https://patchblox.com/security/data/cve/CVE-2025-43244.md) | Urgent | AMD: An app may be able to cause unexpected system termination | 9.8 | 0.0060 | | | [CVE-2025-7424](https://patchblox.com/security/data/cve/CVE-2025-7424.md) | High | Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes | 7.5 | 0.0130 | | | [CVE-2025-43223](https://patchblox.com/security/data/cve/CVE-2025-43223.md) | High | CFNetwork: A non-privileged user may be able to modify restricted network settings | 7.5 | 0.0102 | | | [CVE-2025-43196](https://patchblox.com/security/data/cve/CVE-2025-43196.md) | High | libxpc: An app may be able to gain root privileges | 7.8 | 0.0026 | | | [CVE-2025-43239](https://patchblox.com/security/data/cve/CVE-2025-43239.md) | High | sips: Processing a maliciously crafted file may lead to unexpected app termination | 7.1 | 0.0025 | | | [CVE-2025-24119](https://patchblox.com/security/data/cve/CVE-2025-24119.md) | High | Finder: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges | 7.8 | 0.0024 | | | [CVE-2025-43187](https://patchblox.com/security/data/cve/CVE-2025-43187.md) | High | Disk Images: Running an hdiutil command may unexpectedly execute arbitrary code | 7.8 | 0.0024 | | | [CVE-2025-43248](https://patchblox.com/security/data/cve/CVE-2025-43248.md) | High | AppleMobileFileIntegrity: A malicious app may be able to gain root privileges | 7.8 | 0.0023 | | | [CVE-2025-43249](https://patchblox.com/security/data/cve/CVE-2025-43249.md) | High | AppleMobileFileIntegrity: An app may be able to gain root privileges | 7.8 | 0.0023 | | | [CVE-2025-43270](https://patchblox.com/security/data/cve/CVE-2025-43270.md) | High | Notes: An app may gain unauthorized access to Local Network | 8.8 | 0.0023 | | | [CVE-2025-43254](https://patchblox.com/security/data/cve/CVE-2025-43254.md) | High | file: Processing a maliciously crafted file may lead to unexpected app termination | 7.1 | 0.0023 | | | [CVE-2025-31243](https://patchblox.com/security/data/cve/CVE-2025-31243.md) | High | AppleMobileFileIntegrity: An app may be able to gain root privileges | 7.8 | 0.0022 | | | [CVE-2025-43256](https://patchblox.com/security/data/cve/CVE-2025-43256.md) | High | StorageKit: An app may be able to gain root privileges | 7.8 | 0.0022 | | | [CVE-2025-43247](https://patchblox.com/security/data/cve/CVE-2025-43247.md) | Routine | PackageKit: A malicious app with root privileges may be able to modify the contents of system files | 5.5 | 0.0053 | | | [CVE-2025-43210](https://patchblox.com/security/data/cve/CVE-2025-43210.md) | Routine | CoreMedia: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 6.3 | 0.0040 | | | [CVE-2025-43259](https://patchblox.com/security/data/cve/CVE-2025-43259.md) | Routine | WindowServer: An attacker with physical access to a locked device may be able to view sensitive user information | 4.6 | 0.0030 | | | [CVE-2025-43191](https://patchblox.com/security/data/cve/CVE-2025-43191.md) | Routine | Admin Framework: An app may be able to cause a denial-of-service | 6.2 | 0.0026 | | | [CVE-2025-43250](https://patchblox.com/security/data/cve/CVE-2025-43250.md) | Routine | SharedFileList: An app may be able to break out of its sandbox | 4.0 | 0.0025 | | | [CVE-2025-43226](https://patchblox.com/security/data/cve/CVE-2025-43226.md) | Routine | ImageIO: Processing a maliciously crafted image may result in disclosure of process memory | 4.0 | 0.0025 | | | [CVE-2025-43206](https://patchblox.com/security/data/cve/CVE-2025-43206.md) | Routine | System Settings: An app may be able to access protected user data | 4.0 | 0.0025 | | | [CVE-2025-43260](https://patchblox.com/security/data/cve/CVE-2025-43260.md) | Routine | PackageKit: An app may be able to hijack entitlements granted to other privileged apps | 5.1 | 0.0022 | | | [CVE-2025-43266](https://patchblox.com/security/data/cve/CVE-2025-43266.md) | Routine | NSSpellChecker: An app may be able to break out of its sandbox | 5.1 | 0.0022 | | | [CVE-2025-43195](https://patchblox.com/security/data/cve/CVE-2025-43195.md) | Routine | CoreServices: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43225](https://patchblox.com/security/data/cve/CVE-2025-43225.md) | Routine | Notes: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43246](https://patchblox.com/security/data/cve/CVE-2025-43246.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43241](https://patchblox.com/security/data/cve/CVE-2025-43241.md) | Routine | SceneKit: An app may be able to read files outside of its sandbox | 5.5 | 0.0021 | | | [CVE-2025-43255](https://patchblox.com/security/data/cve/CVE-2025-43255.md) | Routine | GPU Drivers: An app may be able to cause unexpected system termination | 3.3 | 0.0021 | | | [CVE-2025-43197](https://patchblox.com/security/data/cve/CVE-2025-43197.md) | Routine | Single Sign-On: An app may be able to access sensitive user data | 4.0 | 0.0021 | | | [CVE-2025-43238](https://patchblox.com/security/data/cve/CVE-2025-43238.md) | Routine | Xsan: An app may be able to cause unexpected system termination | 6.2 | 0.0020 | | | [CVE-2025-43236](https://patchblox.com/security/data/cve/CVE-2025-43236.md) | Routine | Power Management: An attacker may be able to cause unexpected app termination | 3.3 | 0.0018 | | | [CVE-2025-43282](https://patchblox.com/security/data/cve/CVE-2025-43282.md) | Routine | Kernel: An app may be able to cause unexpected system termination | 5.5 | 0.0016 | | | [CVE-2025-43313](https://patchblox.com/security/data/cve/CVE-2025-43313.md) | Routine | CoreServices: An app may be able to access sensitive user data | 5.5 | 0.0015 | | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.