CVE-2025-30437
Published: 31 March 2025
Summary
CVE-2025-30437 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Apple Macos. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the bounds checking failure (CWE-119) by enforcing comprehensive input validation to prevent invalid inputs from corrupting coprocessor memory.
Provides memory protection mechanisms that safeguard coprocessor memory from unauthorized access or corruption by malicious apps exploiting bounds errors.
Mandates timely flaw remediation through patching, as demonstrated by the fix in macOS Sequoia 15.4 for this specific vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network-exploitable bounds checking vulnerability (CWE-119) in macOS allowing coprocessor memory corruption with no privileges or user interaction required directly maps to exploiting a public-facing application for initial access and code execution.
NVD Description
The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory.
Deeper analysisAI
CVE-2025-30437 is a bounds checking vulnerability (CWE-119) affecting macOS prior to Sequoia 15.4, where an app could corrupt coprocessor memory due to insufficient validation of input bounds. The issue was addressed through improved bounds checks, as detailed in Apple's security advisory.
Remote attackers can exploit this vulnerability over the network (AV:N) without privileges (PR:N) or user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation allows high-impact confidentiality (C:H) and integrity (I:H) violations with no availability impact (A:N) and unchanged scope (S:U), enabling an app to corrupt coprocessor memory, potentially leading to unauthorized data access or modification.
Apple's advisory at https://support.apple.com/en-us/122373 confirms the fix in macOS Sequoia 15.4, recommending immediate updates to mitigate the issue. Additional details appear in the Full Disclosure mailing list at http://seclists.org/fulldisclosure/2025/Apr/8.
Details
- CWE(s)