CVE-2025-24265
Published: 31 March 2025
Summary
CVE-2025-24265 is a critical-severity Out-of-bounds Read (CWE-125) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 44.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24265 is an out-of-bounds read vulnerability (CWE-125) addressed through improved bounds checking in macOS. It affects macOS Sequoia prior to version 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), indicating a network-based attack vector with low attack complexity, no required privileges or user interaction, and unchanged scope. A remote, unauthenticated attacker can exploit it via a malicious app to cause unexpected system termination, with high impacts on confidentiality, integrity, and availability.
Apple's security advisories confirm the issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Mitigation requires updating to these patched versions, as detailed in support documents such as https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, and https://support.apple.com/en-us/122375, along with full disclosure notices on seclists.org.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8945
Vulnerability details
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to cause unexpected system termination.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The out-of-bounds read vulnerability allows remote unauthenticated exploitation leading to system termination, directly enabling application or system exploitation for endpoint denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely patching of known flaws like this out-of-bounds read vulnerability fixed in macOS updates 15.4, 14.7.5, and 13.7.5.
Implements memory safeguards including bounds checking to prevent exploitation of out-of-bounds read vulnerabilities that cause system termination.
Ensures secure error handling to mitigate unexpected system termination resulting from out-of-bounds read errors without fully addressing the underlying memory access flaw.