CVE-2025-8533: Flexibits Fantastical

Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, any local, unprivileged process could connect to the XPC service and access its methods. This issue has been resolved in version 4.0.16.

Affected products

• Flexibits Fantastical: before 4.0.16 (fixed in 4.0.16)

Published 2025-08-07. Last modified 2026-06-17.