Severity
High
Analysis Summary
CVE-2025-43515 CVSS:8.8
Apple Compressor could allow an adjacent attacker on the same network as a Compressor server to execute arbitrary code on the system, caused by missing authorization checks.
CVE-2025-31266 CVSS:6.5
Apple Safari could allow a remote attacker to conduct spoofing attacks. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to spoof the domain name in the title of a pop-up window.
Impact
- Code Execution
- Gain Access
Indicators of Compromise
CVE
CVE-2025-43515
CVE-2025-31266
Affected Vendors
- Apple
Affected Products
- Apple Compressor 4.11.0
- Apple macOS Sequoia 15.4
- Apple Safari 18.4
Remediation
Refer to the Apple security document for patch, upgrade, or suggested workaround information.