CVE-2025-24253
Published: 31 March 2025
Summary
CVE-2025-24253 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by remediating the specific symlink handling flaw through timely application of vendor security patches.
Enforces approved access authorizations to block apps from bypassing protections and accessing sensitive user data via symlinks.
Prevents unauthorized information disclosure through shared system resources exploited by improper symlink handling.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated access to protected user data via symlink mishandling directly enables T1190 (exploiting public-facing apps for initial access) and facilitates T1005 (collecting sensitive data from local system).
NVD Description
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access protected user data.
Deeper analysisAI
CVE-2025-24253 is a vulnerability in macOS involving improper handling of symlinks, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It affects macOS Sequoia prior to version 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. The issue allows an app to access protected user data, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of required privileges or user interaction.
A remote attacker with no privileges can exploit this vulnerability over the network without user interaction. Successful exploitation enables the attacker to gain high-impact access to protected user data, potentially compromising confidentiality, integrity, and availability through the symlink mishandling mechanism.
Apple's security advisories detail the fix as improved symlink handling in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Practitioners should apply these updates promptly, as referenced in Apple support documents (e.g., https://support.apple.com/en-us/122373) and Full Disclosure mailing list postings from April 2025.
Details
- CWE(s)