External risk intelligence

Sublime Text 3 MacOS Dylib Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-65741

The vulnerability affects a local text editor application on macOS. Exploitation requires the attacker to place a malicious library on the user's local filesystem and force the application to load it, which is a local, client-side execution scenario rather than a service reachable over the public internet.

Sublimetext Sublime Text 3

before 3.2.2

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability impacts Sublime Text 3 on macOS, allowing attackers to inject malicious code that runs with the application's privileges. While the primary concern is confirming relevance and exposure, understanding this type of threat is important for maintaining a secure digital environment.

Malicious code execution in text editor.
Impacts code integrity and system security.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into downloading a specially crafted dynamic library. If this library is placed in a specific location and Sublime Text is then launched, the application would load and execute the malicious code, potentially leading to significant compromise.

Entry condition: User downloads malicious library.
Trigger point: Sublime Text loads the library.
Resulting risk: Complete system compromise is possible.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Sublime Text 3 for macOS could allow an attacker to execute arbitrary code within the application's context. This could occur when a user is tricked into opening a malicious dynamic library, leading to potential compromise of the application's environment.

Arbitrary code execution in Sublime Text.
Forced loading of a malicious `.dylib` file.
Compromise of the application's context.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Sublime Text application owner, likely within an IT or development team managing developer tools, is responsible for addressing this vulnerability. The first practical step is to identify all macOS systems running the affected version, confirm if these systems are accessible to unauthorized users, and then plan remediation by coordinating with the vendor for an update or implementing compensating controls.

Application owners must address this.
Verify affected systems and reachability.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Sublime Text 3 and how is it used?

Sublime Text 3 is a sophisticated text editor widely used by developers and programmers to write, edit, and manage source code across various languages. It is highly valued for its speed, extensibility, and customizability, often serving as a primary workspace for software development tasks on macOS.

How does CWE-427 relate to this CVE-2025-65741 issue?

CVE-2025-65741 is identified as a Uncontrolled Search Path Element vulnerability, or CWE-427. In plain terms, this means the software looks for external dynamic libraries (.dylib files) in an insecure way. Because of this, it might accidentally load a malicious file instead of a legitimate one, allowing unauthorized code to run with the application's permissions.

How is the malicious .dylib file triggered?

The vulnerability is triggered when a malicious library is placed in a location where Sublime Text expects to find its own resources. It does not trigger automatically; the application must be launched while the malicious file is present. Simply having the file on your computer is not enough; it must be positioned to intercept the application's search process during startup.

Is my computer at risk for CVE-2025-65741?

Halo Surface Signal notes that this is a local, client-side issue rather than a service reachable over the public internet. Because exploitation requires an attacker to place a file on your local filesystem, the risk is significantly lower for well-protected systems where users do not download or execute untrusted files from unknown sources.

What should I do if I use Sublime Text 3 on macOS?

First, check your installed version to see if it is older than 3.2.2. If you are on an affected version, focus on securing your local development environment by ensuring you only download and run files from trusted, verified sources. Coordinate with your IT team to track if an official vendor update is available for your specific deployment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.