CVE-2025-24176
Published: 27 January 2025
Summary
CVE-2025-24176 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Apple Macos. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the permissions validation flaw by requiring enforcement of approved authorizations to prevent local privilege escalation.
Mitigates privilege escalation by employing least privilege, restricting local attackers to only necessary access rights.
Ensures timely remediation of the specific permissions flaw through patching to versions like macOS Sequoia 15.3.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation vulnerability due to incorrect permissions (CWE-276) directly enables exploitation for privilege escalation on macOS.
NVD Description
A permissions issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local attacker may be able to elevate their privileges.
Deeper analysisAI
CVE-2025-24176 is a permissions issue addressed through improved validation in macOS. It affects macOS Sequoia prior to version 15.3, macOS Sonoma prior to 14.7.3, and macOS Ventura prior to 13.7.3. The vulnerability, associated with CWE-276, carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
A local attacker with low privileges can exploit this vulnerability with low attack complexity and without requiring user interaction. Successful exploitation enables the attacker to elevate their privileges, resulting in high impacts to confidentiality and integrity but no availability impact.
Apple's security advisories confirm the issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3. Mitigation involves updating affected systems to these patched versions, with further details available in the referenced Apple support pages and Full Disclosure mailing list posts.
Details
- CWE(s)