CVE-2025-30464
Published: 31 March 2025
Summary
CVE-2025-30464 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the root cause of the out-of-bounds write by enforcing bounds checking and validation of inputs to prevent kernel memory corruption.
Implements memory safeguards like non-executable memory and address randomization to protect kernel memory from corruption by malicious apps.
Ensures timely identification, reporting, and patching of flaws like this out-of-bounds write vulnerability as demonstrated by Apple's updates.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The kernel out-of-bounds write allows local memory corruption via a malicious app (no privileges required), directly enabling exploitation for privilege escalation to kernel context.
NVD Description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to cause unexpected system termination or corrupt kernel memory.
Deeper analysisAI
CVE-2025-30464 is an out-of-bounds write vulnerability (CWE-787) affecting Apple's macOS operating system. It impacts macOS Sequoia versions prior to 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. The issue stems from insufficient bounds checking and was addressed with improvements to bounds validation.
The vulnerability carries a CVSS v3.1 base score of 7.8 (High), with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. A local attacker requires no privileges but needs user interaction, such as running a malicious app, to exploit it with low attack complexity. Successful exploitation enables the app to cause unexpected system termination or corrupt kernel memory.
Apple's security advisories confirm the vulnerability was fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 through enhanced bounds checking. Further details on the patches and affected components are provided in the referenced support pages from Apple and full disclosure postings on seclists.org.
Details
- CWE(s)