CVE-2025-30456
Published: 31 March 2025
Summary
CVE-2025-30456 is a high-severity Improper Preservation of Permissions (CWE-281) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-30456 is a parsing issue in the handling of directory paths that was addressed through improved path validation. The vulnerability affects Apple's iOS and iPadOS prior to version 18.4, as well as macOS Sequoia prior to 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. It is classified under CWE-281 and has a CVSS v3.1 base score of 7.8.
The vulnerability can be exploited by a local attacker with no privileges required, though it demands low complexity and user interaction. Successful exploitation allows an app to elevate privileges to root level, potentially granting high-impact confidentiality, integrity, and availability compromises within the unchanged scope.
Apple's security advisories detail the fixes in the specified OS updates, recommending users apply patches immediately to mitigate the issue. Relevant documentation is available at support.apple.com/en-us/122371, support.apple.com/en-us/122373, support.apple.com/en-us/122374, support.apple.com/en-us/122375, and seclists.org/fulldisclosure/2025/Apr/10.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8903
Vulnerability details
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to…
more
gain root privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local privilege escalation vulnerability via improper directory path parsing/validation, allowing an unprivileged app to gain root access; this directly maps to T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of directory path inputs to prevent parsing issues that enable apps to escalate to root privileges.
Mandates timely remediation of flaws like the path parsing vulnerability through patching as provided in specified iOS and macOS updates.
Enforces access control policies that path validation supports, mitigating unauthorized root access by unprivileged apps.