CVE-2025-31183
Published: 31 March 2025
Summary
CVE-2025-31183 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 43.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to data containers, directly preventing unauthorized app access to sensitive user data.
Maintains separate execution domains for apps, isolating processes to block cross-container access to sensitive user data.
Applies least privilege to apps, restricting access to only necessary sensitive user data within containers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly enables unauthorized access to sensitive user data stored in local data containers on the system, mapping to T1005 Data from Local System.
NVD Description
The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. An app may be able to access sensitive user…
more
data.
Deeper analysisAI
CVE-2025-31183 is a vulnerability involving improper restriction of data container access, which allows an app to access sensitive user data. It affects Apple's iOS and iPadOS prior to version 18.4, macOS Sequoia prior to 15.4, macOS Sonoma prior to 14.7.5, tvOS prior to 18.4, and watchOS prior to 11.4. Published on March 31, 2025, the issue is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Entity) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
An attacker can exploit this vulnerability remotely over the network with low complexity, requiring no privileges or user interaction. Exploitation enables an app to access sensitive user data, resulting in high impacts to confidentiality, integrity, and availability.
Apple addressed the issue through improved restriction of data container access in the following releases: iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, and watchOS 11.4. Security advisories providing further details are available at https://support.apple.com/en-us/122371, https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, https://support.apple.com/en-us/122376, and https://support.apple.com/en-us/122377.
Details
- CWE(s)