Cyber Resilience

CVE-2025-30431

Apple Macos 13.0 – 13.7.5

Published
11 June 2026
Modified
17 June 2026
Patch / advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0013 3th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-30431 is a medium-severity Protection Mechanism Failure (CWE-693) vulnerability in Apple Macos. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access private information.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-31224Same product: Apple Macos
CVE-2025-31189Same product: Apple Macos
CVE-2024-44122Same product: Apple Macos
CVE-2025-31244Same product: Apple Macos
CVE-2025-43273Same product: Apple Macos
CVE-2025-24284Same product: Apple Macos
CVE-2025-43330Same product: Apple Macos
CVE-2025-43261Same product: Apple Macos
CVE-2026-20701Same product: Apple Macos
CVE-2025-46291Same product: Apple Macos

Affected Assets

apple
macos
13.0 — 13.7.5 · 14.0 — 14.7.5 · 15.0 — 15.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • SC-39 Process Isolation
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 6 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.3.3
  • V6.6.3
  • V10.2.2

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces access control policies to block unauthorized apps from reading private information, addressing the failed checks in this CVE.

prevent

Limits application privileges to only what is required, reducing the impact of a malicious app bypassing intended access restrictions.

prevent

Provides process isolation to prevent one app from accessing memory or resources belonging to another process or private data stores.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

Enforcing authentication directly implements a core protection mechanism whose absence or misuse is the CWE.

PR.AA-05 mostly match
prevents

Defining and enforcing access authorizations is a protection mechanism; proper use prevents the CWE.

PR.DS-01 mostly match
prevents

Cryptographic and integrity controls are protection mechanisms whose correct deployment mitigates the CWE.

PR.DS-02 mostly match
prevents

Encryption and integrity protections for transit are explicit protection mechanisms.

PR.IR-01 mostly match
prevents

Logical network protections are protection mechanisms whose failure matches the CWE.

PR.PS-01 partial match
prevents

Hardened configuration baselines ensure protection mechanisms are correctly applied and maintained.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Systematic verification that security mechanisms operate according to defined standards reduces the likelihood that protection mechanisms are bypassed or disabled.

mitigates

Hardening devices, disabling vulnerable protocols, and maintaining accurate network diagrams reduce the likelihood that a protection mechanism is misconfigured or left in a weak state.

none

Requiring defined escalation paths, crisis activation criteria, and coordination procedures strengthens the overall protection mechanism so that a single control failure is less likely to leave the organization exposed.

none

By requiring a documented categorization and decision process for security events, the control ensures that protection mechanisms are not bypassed or ignored when anomalies occur.

none

Identifying and remediating control weaknesses that contributed to an incident reduces the likelihood that protection mechanisms will fail again.

none

Post-incident analysis that feeds updated risk assessments and additional controls directly reduces the chance that previously exploited weaknesses will recur.

References