CVE-2025-24273
Published: 31 March 2025
Summary
CVE-2025-24273 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely identification, reporting, and patching of the out-of-bounds write flaw in macOS kernel as provided in vendor updates.
Implements memory protection mechanisms like bounds checking and guard pages to prevent out-of-bounds writes from corrupting kernel memory or causing system termination.
Enforces validation of inputs including array bounds to block the exploitation vector of the out-of-bounds write vulnerability in macOS apps targeting kernel.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write enables remote kernel memory corruption for privilege escalation (T1068) and system termination via exploitation (T1499.004).
NVD Description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to cause unexpected system termination or corrupt kernel memory.
Deeper analysisAI
CVE-2025-24273 is an out-of-bounds write vulnerability (CWE-787) affecting Apple's macOS operating system. The issue, addressed through improved bounds checking, impacts macOS Sequoia versions prior to 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact confidentiality, integrity, and availability consequences.
A remote attacker with no privileges or user interaction can exploit this vulnerability over the network with low complexity. Exploitation allows an app to cause unexpected system termination, effectively enabling denial-of-service, or to corrupt kernel memory, which could facilitate further privilege escalation or persistent system compromise.
Apple's security advisories detail the fix via improved bounds checking in the specified macOS updates (https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, https://support.apple.com/en-us/122375). Additional details appear in full disclosure postings (http://seclists.org/fulldisclosure/2025/Apr/10, http://seclists.org/fulldisclosure/2025/Apr/8). Security practitioners should prioritize patching affected systems to mitigate risks.
Details
- CWE(s)