Vulnerability in Apple macOS
CVE-2025-14714
An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.001 (2.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 2.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: -0.000
Affected products
- Apple macOS
- Libreoffice
- The Document Foundation Libreoffice — versions 25.2
Weakness classification (CWE)
References
- www.libreoffice.org/about-us/security/advisories/cve-2025-14714 (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-14714?
- CVE-2025-14714 is a medium-severity vulnerability in Apple macOS, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 6.5/10. Published 2025-12-15.
- How severe is CVE-2025-14714?
- Medium severity. CVSS v3 base score is 6.5 out of 10.