Vulnerability · Published Oct 7, 2025 · Assigned by AMZN
CVE-2025-11462Local Privilege Escalation Vulnerability in AWS Client VPN macOS Client
High 7.8
In plain English
A high-severity security flaw in Client VPN from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the log destination directory during log rotation could allow a non-administrator user to create a symlink from a client log file to a privileged location. On log rotation, this could lead to code execution with root privileges if the user made crafted API calls which injected arbitrary code into the log file. We recommend users upgrade to AWS VPN Client for macOS 5.2.1 or the latest version.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AWS | Client VPN | 1.3.2 – before 5.2.1 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H