CVE-2025-24120
Apple Macos ≤ 13.7.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-24120 is a high-severity Missing Release of Resource after Effective Lifetime (CWE-772) vulnerability in Apple Macos. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 43% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-24120 is a vulnerability stemming from inadequate management of object lifetimes, classified under CWE-772 (Missing Release of Resource after Effective Lifetime). It affects macOS systems, specifically versions prior to the patched releases of macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3. The issue was publicly disclosed on January 27, 2025, and carries a CVSS v3.1 base score of 7.5, reflecting its potential for high-impact denial of service without confidentiality or integrity disruption.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables the attacker to trigger unexpected application termination, resulting in a denial-of-service condition on the targeted macOS app. The attack does not escalate privileges or compromise data, but its network accessibility and ease of execution make it a notable risk for availability.
Apple's security advisories detail the fix through enhanced object lifetime management and recommend updating to macOS Sequoia 15.3, macOS Sonoma 14.7.3, or macOS Ventura 13.7.3. Additional details are available in the referenced support bulletins at https://support.apple.com/en-us/122068, https://support.apple.com/en-us/122069, and https://support.apple.com/en-us/122070, along with Full Disclosure mailing list entries.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3631
Vulnerability Data
This issue was addressed by improved management of object lifetimes. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An attacker may be able to cause unexpected app termination.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing resource releases through dynamic analysis or stress testing.
Requiring documented development standards and tools can mandate explicit resource-release patterns in code.
Resource-quota allocation limits the blast radius of an unreleased-resource exhaustion condition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Lifecycle management explicitly requires handling resources through end-of-life including release.
Secure SDLC practices directly prevent missing resource-release defects during development.
Runtime monitoring may surface resource-exhaustion symptoms but does not address release logic.
Capacity monitoring can detect exhaustion caused by unreleased resources but does not prevent the root defect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit information-deletion requirements directly address timely release of resources after use.
Secure-SDLC practices include resource-management reviews, yet the control covers the entire lifecycle, not just this weakness.
Secure-coding rules can mandate explicit resource-release patterns, but the control is broader than this single weakness.
Change-management processes may catch missing de-allocation during reviews, but the control itself does not target resource lifetime.
Configuration baselines can enforce resource limits or timeouts, indirectly reducing exposure to leaks.