CVE-2025-24231
Published: 31 March 2025
Summary
CVE-2025-24231 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-3 enforces approved authorizations preventing apps from accessing or modifying protected file system parts, directly addressing the insufficient checks bypassed in this CVE.
AC-25 implements a reference monitor to mediate and securely enforce access control decisions on file system objects, mitigating the out-of-bounds write exploitation.
SI-16 provides memory protections that prevent out-of-bounds writes from enabling unauthorized modifications to protected file system regions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write allowing unprivileged app to modify protected file system areas directly enables exploitation for privilege escalation by bypassing OS protections.
NVD Description
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modify protected parts of the file system.
Deeper analysisAI
CVE-2025-24231 is a vulnerability classified under CWE-787 (Out-of-bounds Write) that affects macOS Sequoia prior to version 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. The flaw enables an app to modify protected parts of the file system due to insufficient checks, as detailed in the CVE description published on 2025-03-31.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it remotely exploitable over a network with low attack complexity, no required privileges, and no user interaction. Any remote attacker can leverage a malicious app to achieve high impacts on confidentiality, integrity, and availability by altering protected file system regions.
Apple's advisories confirm the issue was addressed through improved checks in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Additional details are available in security content updates at https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, and https://support.apple.com/en-us/122375, along with full disclosures at http://seclists.org/fulldisclosure/2025/Apr/10 and http://seclists.org/fulldisclosure/2025/Apr/8.
Details
- CWE(s)