CVE-2025-24139
Published: 27 January 2025
Summary
CVE-2025-24139 is a medium-severity Out-of-bounds Write (CWE-787) vulnerability in Apple Macos. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 6.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through patching directly eliminates the parsing vulnerability in macOS that leads to application crashes from malicious files.
Memory protection mechanisms such as bounds checking prevent out-of-bounds writes during file parsing that cause unexpected app terminations.
Information input validation ensures maliciously crafted files are rejected or sanitized before parsing, mitigating the risk of application crashes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables crashing a target application via malicious file parsing (out-of-bounds write leading to termination), directly mapping to application exploitation for denial of service.
NVD Description
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, macOS Ventura 13.7.5. Parsing a maliciously crafted file may lead to an unexpected app termination.
Deeper analysisAI
CVE-2025-24139 is a vulnerability in macOS that allows parsing a maliciously crafted file to lead to an unexpected application termination. The issue, addressed through improved checks, affects macOS versions prior to Sequoia 15.3, Sonoma 14.7.3, Ventura 13.7.3, and Ventura 13.7.5. It carries a CVSS v3.1 base score of 5.5 (medium severity) and is associated with CWE-787 (out-of-bounds write), though additional CWE details are unavailable from NVD.
Exploitation requires local access with low complexity and no privileges, but user interaction is necessary to open the malicious file. A local attacker can achieve high availability impact by causing the targeted application to crash, with no effects on confidentiality or integrity and no scope change.
Apple security advisories, detailed in support pages such as https://support.apple.com/en-us/122068, https://support.apple.com/en-us/122069, https://support.apple.com/en-us/122070, https://support.apple.com/en-us/122375, and http://seclists.org/fulldisclosure/2025/Apr/10, confirm mitigation via updates to the listed macOS versions.
Details
- CWE(s)