PT-2025-32260 · Flexibits · Fantastical

Karol Mazurek + 1 · Published 2025-08-07 · Updated 2025-08-07 · CVE-2025-8533

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Fantastical versions prior to 4.0.16

Description A flaw exists in the XPC services of Fantastical where proper client authorization checks were not implemented in the listener:shouldAcceptNewConnection method. This allowed any local, unprivileged process to connect to the XPC service and access its methods.

Recommendations Update to version 4.0.16 or later.

Fix

LPE

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-8533

Affected Products

Fantastical

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-8533 · Security Note
• https://cert.pl/en/posts/2025/08/CVE-2025-8533 · Note
• https://twitter.com/CVEnew/status/1953400365451559247 · Twitter Post
• https://t.me/CVEtracker/29426 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1953403638824497478 · Twitter Post
• https://t.me/cveNotify/131213 · Telegram Post
• https://flexibits.com/fantastical · Note