Vulnerability in Apple Macos
CVE-2025-14714
An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.
EPSS: 0.001 (2.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Apple Macos
- Libreoffice
- The Document Foundation Libreoffice — versions 25.2
Weakness classification (CWE)
References
- security@documentfoundation.org (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-14714?
- CVE-2025-14714 is a medium-severity vulnerability in Apple Macos, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 6.5/10. Published 2025-12-15.
- How severe is CVE-2025-14714?
- Medium severity. CVSS v3 base score is 6.5 out of 10.