# Sonoma 14.8.2 Sonoma 14.8.2, released November 3, 2025, fixes 50 CVEs in Sonoma. 2 of them are being exploited (CVE-2025-43520); 2 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/macos/sonoma-14.8.2 - Platform: macOS - Released: Nov 3, 2025 - Priority: Patch now (Closes CVE-2025-43520, exploited (CISA KEV)) - CVEs: 50, exploited: 2, on CISA KEV: 2 - Vendor advisory: https://support.apple.com/en-us/125636 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Sonoma](https://patchblox.com/security/data/product/macos/sonoma.md) | | 14.8.2 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-43520](https://patchblox.com/security/data/cve/CVE-2025-43520.md) | Patch now | Kernel: A malicious application may be able to cause unexpected system termination or write kernel memory | 5.5 | 0.0043 | CISA KEV | | [CVE-2025-43510](https://patchblox.com/security/data/cve/CVE-2025-43510.md) | Patch now | Kernel: A malicious application may cause unexpected changes in memory shared between processes | 7.8 | 0.0036 | CISA KEV | | [CVE-2025-30465](https://patchblox.com/security/data/cve/CVE-2025-30465.md) | Urgent | Shortcuts: A shortcut may be able to access files that are normally inaccessible to the Shortcuts app | 9.8 | 0.0107 | | | [CVE-2025-6965](https://patchblox.com/security/data/cve/CVE-2025-6965.md) | High | SQLite: Processing a file may lead to memory corruption | 7.7 | 0.7345 | | | [CVE-2024-49761](https://patchblox.com/security/data/cve/CVE-2024-49761.md) | High | Ruby: Multiple issues in ruby | 7.5 | 0.0142 | | | [CVE-2025-43401](https://patchblox.com/security/data/cve/CVE-2025-43401.md) | High | CoreAnimation: A remote attacker may be able to cause a denial-of-service | 7.5 | 0.0103 | | | [CVE-2025-43413](https://patchblox.com/security/data/cve/CVE-2025-43413.md) | High | libxpc: A sandboxed app may be able to observe system-wide network connections | 7.5 | 0.0063 | | | [CVE-2025-43405](https://patchblox.com/security/data/cve/CVE-2025-43405.md) | High | Photos: An app may be able to access user-sensitive data | 7.5 | 0.0059 | | | [CVE-2025-43494](https://patchblox.com/security/data/cve/CVE-2025-43494.md) | High | Mail: An attacker may be able to cause a persistent denial-of-service | 7.5 | 0.0057 | | | [CVE-2025-43373](https://patchblox.com/security/data/cve/CVE-2025-43373.md) | High | Wi-Fi: An app may be able to cause unexpected system termination or corrupt kernel memory | 7.5 | 0.0049 | | | [CVE-2025-43338](https://patchblox.com/security/data/cve/CVE-2025-43338.md) | High | ImageIO: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 7.1 | 0.0026 | | | [CVE-2025-43361](https://patchblox.com/security/data/cve/CVE-2025-43361.md) | High | Audio: A malicious app may be able to read kernel memory | 7.8 | 0.0021 | | | [CVE-2025-43476](https://patchblox.com/security/data/cve/CVE-2025-43476.md) | High | SharedFileList: An app may be able to break out of its sandbox | 7.8 | 0.0020 | | | [CVE-2025-43407](https://patchblox.com/security/data/cve/CVE-2025-43407.md) | High | Assets: An app may be able to break out of its sandbox | 7.8 | 0.0020 | | | [CVE-2025-43472](https://patchblox.com/security/data/cve/CVE-2025-43472.md) | High | zsh: An app may be able to gain root privileges | 7.8 | 0.0020 | | | [CVE-2025-43474](https://patchblox.com/security/data/cve/CVE-2025-43474.md) | High | GPU Drivers: An app may be able to cause unexpected system termination or read kernel memory | 7.8 | 0.0020 | | | [CVE-2024-43398](https://patchblox.com/security/data/cve/CVE-2024-43398.md) | Routine | Ruby: Multiple issues in ruby | 5.9 | 0.0121 | | | [CVE-2025-43445](https://patchblox.com/security/data/cve/CVE-2025-43445.md) | Routine | CoreText: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 4.3 | 0.0112 | | | [CVE-2025-31199](https://patchblox.com/security/data/cve/CVE-2025-31199.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.5 | 0.0052 | | | [CVE-2025-43372](https://patchblox.com/security/data/cve/CVE-2025-43372.md) | Routine | ImageIO: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 6.5 | 0.0052 | | | [CVE-2025-6442](https://patchblox.com/security/data/cve/CVE-2025-6442.md) | Routine | Ruby: Multiple issues in ruby | 6.5 | 0.0050 | | | [CVE-2025-43448](https://patchblox.com/security/data/cve/CVE-2025-43448.md) | Routine | CloudKit: An app may be able to break out of its sandbox | 6.3 | 0.0032 | | | [CVE-2025-43408](https://patchblox.com/security/data/cve/CVE-2025-43408.md) | Routine | Share Sheet: An attacker with physical access may be able to access contacts from the lock screen | 2.4 | 0.0026 | | | [CVE-2025-43394](https://patchblox.com/security/data/cve/CVE-2025-43394.md) | Routine | bootp: An app may be able to access protected user data | 5.5 | 0.0025 | | | [CVE-2025-43410](https://patchblox.com/security/data/cve/CVE-2025-43410.md) | Routine | Notes: An attacker with physical access may be able to view deleted notes | 2.4 | 0.0025 | | | [CVE-2025-43348](https://patchblox.com/security/data/cve/CVE-2025-43348.md) | Routine | Finder: An app may bypass Gatekeeper checks | 5.5 | 0.0024 | | | [CVE-2025-43446](https://patchblox.com/security/data/cve/CVE-2025-43446.md) | Routine | Assets: An app may be able to modify protected parts of the file system | 5.5 | 0.0023 | | | [CVE-2025-43395](https://patchblox.com/security/data/cve/CVE-2025-43395.md) | Routine | configd: An app may be able to access protected user data | 3.3 | 0.0022 | | | [CVE-2025-43382](https://patchblox.com/security/data/cve/CVE-2025-43382.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43379](https://patchblox.com/security/data/cve/CVE-2025-43379.md) | Routine | AppleMobileFileIntegrity: An app may be able to access protected user data | 5.5 | 0.0021 | | | [CVE-2025-43322](https://patchblox.com/security/data/cve/CVE-2025-43322.md) | Routine | Admin Framework: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43334](https://patchblox.com/security/data/cve/CVE-2025-43334.md) | Routine | sudo: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43335](https://patchblox.com/security/data/cve/CVE-2025-43335.md) | Routine | Security: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43411](https://patchblox.com/security/data/cve/CVE-2025-43411.md) | Routine | PackageKit: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43479](https://patchblox.com/security/data/cve/CVE-2025-43479.md) | Routine | CoreServices: An app may be able to access sensitive user data | 5.5 | 0.0021 | | | [CVE-2025-43391](https://patchblox.com/security/data/cve/CVE-2025-43391.md) | Routine | Photos: An app may be able to access sensitive user data | 5.5 | 0.0021 | | | [CVE-2025-43336](https://patchblox.com/security/data/cve/CVE-2025-43336.md) | Routine | SoftwareUpdate: An app with root privileges may be able to access private information | 4.4 | 0.0020 | | | [CVE-2025-43398](https://patchblox.com/security/data/cve/CVE-2025-43398.md) | Routine | Kernel: An app may be able to cause unexpected system termination | 5.5 | 0.0020 | | | [CVE-2025-43380](https://patchblox.com/security/data/cve/CVE-2025-43380.md) | Routine | sips: Parsing a file may lead to an unexpected app termination | 5.5 | 0.0020 | | | [CVE-2025-43396](https://patchblox.com/security/data/cve/CVE-2025-43396.md) | Routine | Installer: A sandboxed app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43477](https://patchblox.com/security/data/cve/CVE-2025-43477.md) | Routine | Siri: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43498](https://patchblox.com/security/data/cve/CVE-2025-43498.md) | Routine | FileProvider: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43389](https://patchblox.com/security/data/cve/CVE-2025-43389.md) | Routine | Notes: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43499](https://patchblox.com/security/data/cve/CVE-2025-43499.md) | Routine | Shortcuts: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43469](https://patchblox.com/security/data/cve/CVE-2025-43469.md) | Routine | NSSpellChecker: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43397](https://patchblox.com/security/data/cve/CVE-2025-43397.md) | Routine | SoftwareUpdate: An app may be able to cause a denial-of-service | 5.5 | 0.0018 | | | [CVE-2025-43478](https://patchblox.com/security/data/cve/CVE-2025-43478.md) | Routine | ASP TCP: An app may be able to cause unexpected system termination | 5.5 | 0.0018 | | | [CVE-2025-43412](https://patchblox.com/security/data/cve/CVE-2025-43412.md) | Routine | TCC: An app may be able to break out of its sandbox | 6.3 | 0.0018 | | | [CVE-2025-43420](https://patchblox.com/security/data/cve/CVE-2025-43420.md) | Routine | Dock: An app may be able to access sensitive user data | 4.7 | 0.0014 | | | [CVE-2025-43468](https://patchblox.com/security/data/cve/CVE-2025-43468.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0013 | | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.