CVE-2025-57443

MEDIUM EPSS 2.6%

Published Oct 2, 20259mo ago · Modified Jun 17, 20262w ago

5.1 CVSS 3.1

Medium

Published Oct 2, 2025 9mo ago

Last Modified Jun 17, 2026 2w ago

Description

FrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-library-validation) that allow unprivileged local attackers to inject code into the FrostWire process via the DYLD_INSERT_LIBRARIES environment variable. This allows escalated privileges to arbitrary TCC-approved directories.

CVSS Details

Base Score

5.1

Exploitability

2.5

Impact

2.5

Vector string

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector Local

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

2.6% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-269 Improper Privilege Management Authorization

References 1

github.com https://github.com/SwayZGl1tZyyy/vulnerability-research/tree/main/CVE-2025-57443

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.