CVE-2025-24094

Race Condition in macOS Enabling Unauthorized Access to User Sensitive Data

Published Jan 27, 2025 CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Description

A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access user-sensitive data.

Analysis

Technical impact

A race condition was discovered in macOS that allows a malicious application to read user‑sensitive data before proper validation occurs. The flaw is identified as CWE‑362 and can lead to unintended data leakage, compromising confidentiality but not integrity or availability. The vulnerability requires local code execution and exploits a timing gap between concurrent processes that access protected information.

Affected Systems

Apple macOS is affected, and the vulnerability exists in all releases prior to the following security updates: Sequoia 15.3, Sonoma 14.7.3, and Ventura 13.7.3. Systems running older versions are at risk.

Risk and Exploitability

The CVSS score of 4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, reducing priority for immediately critical remediation. The likely attack vector is local, requiring a process to run with user or higher privileges to trigger the race condition and gain access to sensitive data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 13.7.3
`0`	affected	< 14.7.3
`0`	affected	< 15.3

Configuration 1 [-]

OR	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade macOS to Sequoia 15.3, Sonoma 14.7.3, Ventura 13.7.3, or a newer release that includes the race‑condition fix.
Evaluate third‑party applications that run with elevated privileges and remove or restrict any that are not strictly necessary for business operations.
After updating, enforce App Sandbox restrictions for sensitive files and verify that operating system permissions are appropriately configured to limit unexpected data access.

Generated by OpenCVE AI on April 28, 2026 at 04:12 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-3612	A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to access user-sensitive data.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.174% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Jan/15
http://seclists.org/fulldisclosure/2025/Jan/16
http://seclists.org/fulldisclosure/2025/Jan/17
https://support.apple.com/en-us/122068
https://support.apple.com/en-us/122069
https://support.apple.com/en-us/122070

History

Apr 28, 2026 4:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Race Condition in macOS Enabling Unauthorized Access to User Sensitive Data

Apr 2, 2026 8:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to access user-sensitive data.	A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access user-sensitive data.

Nov 3, 2025 9:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Jan/15 http://seclists.org/fulldisclosure/2025/Jan/16 http://seclists.org/fulldisclosure/2025/Jan/17

Feb 4, 2025 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

Jan 30, 2025 6:45 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos
Weaknesses		CWE-362
CPEs		cpe:2.3:o:apple:macos::::::::
Vendors & Products		Apple Apple macos
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Jan 27, 2025 10:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to access user-sensitive data.
References		https://support.apple.com/en-us/122068 https://support.apple.com/en-us/122069 https://support.apple.com/en-us/122070