CVE-2025-24233
Published: 31 March 2025
Summary
CVE-2025-24233 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 35.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-11 (User-installed Software).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and patching of the macOS permissions flaw, directly addressing the root cause of the vulnerability.
Enforces approved authorizations for access to protected files, preventing malicious apps from reading or writing to them.
Prohibits or restricts user-installed software, blocking the installation and execution of malicious apps that exploit the permissions issue.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly enables unauthorized read access to protected files (T1005 Data from Local System) and write access facilitating tampering (T1565.001 Stored Data Manipulation) or destruction (T1485 Data Destruction) of system/user data.
NVD Description
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to read or write to protected files.
Deeper analysisAI
CVE-2025-24233 is a permissions issue, classified under CWE-863 (Incorrect Authorization), that was addressed through additional restrictions in Apple macOS. The vulnerability affects macOS Sequoia versions prior to 15.4, macOS Sonoma versions prior to 14.7.5, and macOS Ventura versions prior to 13.7.5. It enables a malicious app to bypass intended protections and read or write to protected files, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to high impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited by an attacker with network access who delivers a malicious app to the target system, requiring no special privileges or user interaction beyond the app's installation. Once running, the app can access and modify protected files, potentially leading to unauthorized data exfiltration, tampering with system or user data, or disruption of services.
Apple security advisories detail the fix via additional permissions restrictions in the specified macOS updates (macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5). Practitioners should prioritize patching affected systems, as referenced in Apple's support documentation and full disclosure notices.
Details
- CWE(s)