CVE-2025-24195
Published: 31 March 2025
Summary
CVE-2025-24195 is a critical-severity Incorrect Default Permissions (CWE-276) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-24195 by requiring timely identification, reporting, and remediation of the integer overflow flaw through vendor patches like macOS 15.4.
Addresses the root cause of the vulnerability by enforcing validation of all information inputs to prevent integer overflows exploitable for privilege escalation.
Mitigates potential memory corruption from integer overflows that could enable remote privilege escalation through mechanisms like address space layout randomization and data execution prevention.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow with remote unauthenticated exploitation directly enables privilege escalation on macOS, mapping to T1068 Exploitation for Privilege Escalation.
NVD Description
An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A user may be able to elevate privileges.
Deeper analysisAI
CVE-2025-24195 is an integer overflow vulnerability that was addressed with improved input validation. It affects macOS Sequoia prior to version 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. Published on 2025-03-31, the issue is linked to CWE-276 and has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical severity.
The vulnerability can be exploited remotely by an unauthenticated attacker requiring no privileges or user interaction, with low attack complexity over the network. Successful exploitation enables a user to elevate privileges on the affected system.
Apple's security advisories detail the fixes in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Practitioners should prioritize patching affected systems, with further details available at https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, https://support.apple.com/en-us/122375, http://seclists.org/fulldisclosure/2025/Apr/10, and http://seclists.org/fulldisclosure/2025/Apr/8.
Details
- CWE(s)