CVE-2025-43278 is a vulnerability in Apple macOS where an application may gain unauthorized access to protected user data because of inadequate handling of symbolic links (CWE-61). This flaw affects macOS versions before 15.4 and was resolved by improving symlink handling in macOS Sequoia 15.4. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity level. There are no known exploits in the wild, and no official remediation level or patch link was provided in the source data, but the fix is included in macOS 15.4.

An attacker could exploit this vulnerability to access protected user data without proper authorization. The impact is limited to confidentiality (high impact on confidentiality), with no impact on integrity or availability. The attack vector requires local access with low attack complexity and no privileges, but user interaction is required.

This vulnerability is fixed in macOS Sequoia 15.4. Users and administrators should update affected systems to macOS 15.4 or later to remediate this issue. Patch status is confirmed by the vendor advisory stating the issue is addressed in version 15.4. No additional mitigation steps are specified.