CVE-2025-65741
📋 TL;DR
CVE-2025-65741 allows attackers to inject malicious dynamic libraries (.dylib files) into Sublime Text 3 on macOS, enabling arbitrary code execution within the application's context. This affects macOS users running vulnerable Sublime Text 3 versions. The vulnerability requires local access or social engineering to deliver the malicious library.
💻 Affected Systems
- Sublime Text 3
📦 What is this software?
Sublime Text 3 by Sublimetext
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via privilege escalation, data theft, or ransomware deployment if Sublime Text has elevated privileges.
Likely Case
Local privilege escalation, data exfiltration from files opened in Sublime Text, or persistence mechanisms installation.
If Mitigated
Limited impact if application runs with minimal privileges and file integrity monitoring detects unauthorized library loads.
🎯 Exploit Status
Proof-of-concept available on GitHub. Requires user to execute malicious .dylib file or be tricked into loading it.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Build 3209 or later
Vendor Advisory: https://www.sublimetext.com/3
Restart Required: Yes
Instructions:
1. Open Sublime Text 3
2. Go to Sublime Text > Check for Updates
3. Install available update
4. Restart Sublime Text
🔧 Temporary Workarounds
Restrict Library Loading
macOSUse macOS sandboxing or entitlements to restrict dynamic library loading
Application Whitelisting
macOSUse macOS Parental Controls or third-party tools to restrict which applications can load libraries
🧯 If You Can't Patch
- Run Sublime Text with reduced privileges using sandbox-exec
- Monitor for suspicious .dylib file creation/modification in Sublime Text directories
🔍 How to Verify
Check if Vulnerable:
Check Sublime Text version via 'Sublime Text > About Sublime Text'. If version is Build 3208 or earlier, system is vulnerable.Check Version:
defaults read /Applications/Sublime\ Text.app/Contents/Info.plist CFBundleVersionVerify Fix Applied:
Verify version is Build 3209 or later in About dialog. Test with known PoC from GitHub repository.📡 Detection & Monitoring
Log Indicators:
- Console logs showing unexpected library loads
- Sublime Text crash reports with foreign libraries
Network Indicators:
- Unexpected outbound connections from Sublime Text process
SIEM Query:
process.name:"Sublime Text" AND event.action:"library_load" AND NOT library.path:"/Applications/Sublime Text.app/*"