CVE-2025-30462
Published: 31 March 2025
Summary
CVE-2025-30462 is a critical-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 41.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-39 (Process Isolation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely identification, reporting, and application of patches that fix the library injection vulnerability in macOS.
Enforces approved authorizations to prevent apps from bypassing App Sandbox restrictions through unauthorized library injection.
Maintains process isolation via sandboxing to block execution without restrictions despite apparent sandbox usage.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables library injection by bypassing macOS App Sandbox (improper access control), directly facilitating Dylib Hijacking for code execution, Exploitation for Privilege Escalation to gain elevated access, and Exploitation for Defense Evasion to subvert sandbox protections.
NVD Description
A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. Apps that appear to use App Sandbox may be able to launch without restrictions.
Deeper analysisAI
CVE-2025-30462 is a library injection vulnerability (CWE-284: Improper Access Control) affecting macOS systems prior to the patched versions. The issue allows apps that appear to use App Sandbox to launch without restrictions, enabling unauthorized bypass of sandbox protections. It was addressed with additional restrictions in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited remotely by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, such as injecting malicious libraries to evade App Sandbox and gain elevated privileges or execute arbitrary code on targeted macOS systems.
Apple security advisories detail the fix through additional library injection restrictions in the specified macOS updates. Practitioners should apply macOS Sequoia 15.4, Sonoma 14.7.5, or Ventura 13.7.5 immediately. Further details are available in Apple's updates at https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, and https://support.apple.com/en-us/122375, along with full disclosure notes at http://seclists.org/fulldisclosure/2025/Apr/10 and http://seclists.org/fulldisclosure/2025/Apr/8.
Details
- CWE(s)