CVE-2025-24255
Published: 31 March 2025
Summary
CVE-2025-24255 is a high-severity Improper Input Validation (CWE-20) vulnerability in Apple Macos. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 14.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-24255 is a file access vulnerability stemming from insufficient input validation, affecting macOS Sequoia prior to version 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. The flaw, classified under CWE-20 (Improper Input Validation), enables an app to break out of its sandbox restrictions. It received a CVSS v3.1 base score of 8.4 (High), reflecting local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).
A local attacker can exploit this vulnerability by running a malicious app on the targeted system. No special privileges or user interaction are needed, allowing low-complexity exploitation. Successful exploitation permits the app to escape its sandbox, potentially granting unauthorized access to sensitive files and system resources, leading to high-impact compromise of confidentiality, integrity, and availability.
Apple's security advisories detail the fix through improved input validation in the specified macOS updates: Sequoia 15.4, Sonoma 14.7.5, and Ventura 13.7.5. Security practitioners should prioritize patching affected systems, as referenced in Apple's support pages (e.g., HT122373, HT122374, HT122375) and Full Disclosure mailing list announcements.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8948
Vulnerability details
A file access issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to break out of its sandbox.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables a local malicious app to escape macOS sandbox restrictions through improper input validation, directly facilitating exploitation for privilege escalation to access unauthorized files and system resources.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper input validation (CWE-20) that enables malicious apps to break out of macOS sandbox restrictions.
Enforces sandbox access control policies to prevent unauthorized file access and resource escalation by confined applications.
Requires timely identification, reporting, and patching of the specific input validation flaw fixed in macOS updates 15.4, 14.7.5, and 13.7.5.