Vulnerability · Published Aug 7, 2025 · Assigned by CERT-PL

CVE-2025-8533Incorrect Authorization of XPC Service in Fantastical.app

Medium 6.9

In plain English

A medium-severity incorrect authorization in Fantastical from Flexibits. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, any local, unprivileged process could connect to the XPC service and access its methods. This issue has been resolved in version 4.0.16.

Affected products (as reported)

Vendor	Product	Versions
Flexibits	Fantastical	0 – before 4.0.16

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2025/08/CVE-2025-8533 third-party-advisory
https://flexibits.com/fantastical product