Cyber Resilience

CVE-2025-31224

Apple Macos ≤ 13.7.6

Published
12 May 2025
Modified
17 June 2026
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-31224 is a high-severity Protection Mechanism Failure (CWE-693) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).

Operationally, ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-24 (Access Control Decisions) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to bypass certain Privacy preferences.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-31189Same product: Apple Macos
CVE-2024-44122Same product: Apple Macos
CVE-2025-31244Same product: Apple Macos
CVE-2025-43273Same product: Apple Macos
CVE-2025-24284Same product: Apple Macos
CVE-2025-43330Same product: Apple Macos
CVE-2025-30431Same product: Apple Macos
CVE-2025-43261Same product: Apple Macos
CVE-2026-20701Same product: Apple Macos
CVE-2025-46291Same product: Apple Macos

Affected Assets

apple
macos
≤ 13.7.6 · 14.0 — 14.7.6 · 15.0 — 15.5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • AC-24 Access Control Decisions
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 6 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.3.3
  • V6.6.3
  • V10.2.2

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces privacy-preference access decisions so an app cannot bypass the checks that grant or deny resource access.

prevent

Limits the privileges an app can obtain, reducing the impact of any successful bypass of privacy-preference enforcement.

prevent

Requires that access-control decisions (including privacy preferences) are made by a trusted mechanism rather than being circumvented by application logic.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

Enforcing authentication directly implements a core protection mechanism whose absence or misuse is the CWE.

PR.AA-05 mostly match
prevents

Defining and enforcing access authorizations is a protection mechanism; proper use prevents the CWE.

PR.DS-01 mostly match
prevents

Cryptographic and integrity controls are protection mechanisms whose correct deployment mitigates the CWE.

PR.DS-02 mostly match
prevents

Encryption and integrity protections for transit are explicit protection mechanisms.

PR.IR-01 mostly match
prevents

Logical network protections are protection mechanisms whose failure matches the CWE.

PR.PS-01 partial match
prevents

Hardened configuration baselines ensure protection mechanisms are correctly applied and maintained.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Systematic verification that security mechanisms operate according to defined standards reduces the likelihood that protection mechanisms are bypassed or disabled.

mitigates

Hardening devices, disabling vulnerable protocols, and maintaining accurate network diagrams reduce the likelihood that a protection mechanism is misconfigured or left in a weak state.

none

Requiring defined escalation paths, crisis activation criteria, and coordination procedures strengthens the overall protection mechanism so that a single control failure is less likely to leave the organization exposed.

none

By requiring a documented categorization and decision process for security events, the control ensures that protection mechanisms are not bypassed or ignored when anomalies occur.

none

Identifying and remediating control weaknesses that contributed to an incident reduces the likelihood that protection mechanisms will fail again.

none

Post-incident analysis that feeds updated risk assessments and additional controls directly reduces the chance that previously exploited weaknesses will recur.

References