CVE-2025-30452
Published: 31 March 2025
Summary
CVE-2025-30452 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates validation of all information inputs, comprehensively addressing the improper input validation (CWE-20) vulnerability exploited in this CVE.
Requires identification, reporting, and remediation of flaws such as this critical input validation issue via timely patching to fixed macOS versions.
Restricts information inputs to organization-defined content types, providing additional mitigation against malformed inputs targeting this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated input validation flaw enables arbitrary code execution on macOS, directly mapping to public-facing application exploitation for initial access and Unix shell command execution.
NVD Description
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An input validation issue was addressed.
Deeper analysisAI
CVE-2025-30452 is an input validation issue, classified under CWE-20 (Improper Input Validation), affecting macOS Sequoia prior to version 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. The vulnerability was addressed by implementing improved checks, as detailed in Apple's security updates published on 2025-03-31.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity. Remote attackers require no privileges or user interaction to exploit it over the network with low complexity, potentially achieving high impacts on confidentiality, integrity, and availability, such as arbitrary code execution or system compromise.
Apple's security advisories, available at support.apple.com/en-us/122373, 122374, and 122375, confirm the issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Security practitioners should prioritize updating affected systems, with further technical details in the Full Disclosure mailing list archives at seclists.org/fulldisclosure/2025/Apr/10 and /Apr/8.
Details
- CWE(s)