CVE-2025-8533 Details
Description
A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, any local, unprivileged process could connect to the XPC service and access its methods. This issue has been resolved in version 4.0.16.
A vulnerability exists in the XPC services of Flexibits Fantastical, all versions prior to 4.0.16. The issue arises from inadequate client authorization checks in the 'listener:shouldAcceptNewConnection' method, which allows any local, unprivileged process to connect to the XPC service and access its methods. This flaw could be exploited by any local process without special privileges.
Users can upgrade to Fantastical version 4.0.16 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2025CISA-ADP
Assessed Aug 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/en/posts/2025/08/CVE-2025-8533 | [email protected] | AdvisoryRemedy |
| https://flexibits.com/fantastical | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flexibits Fantastical | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2025 | New CVE Received | [email protected] |