CVE-2025-8533 MEDIUM

CVE-2025-8533: Incorrect Authorization of XPC Service in Fantastical.app

Vendor Flexibits
Product Fantastical
Weakness CWE-863 · Incorrect authorization
Published August 7, 2025
Last update August 7, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, any local, unprivileged process could connect to the XPC service and access its methods. This issue has been resolved in version 4.0.16.

Key dates

02Disclosure timeline

August 7, 2025 CVE published
August 7, 2025 Record updated