CVE-2025-24240

Race Condition Allows Unauthorized Access to User‑Sensitive Data

View on CVE.org
Published Mar 31, 2025 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Description
A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access user-sensitive data.

Analysis

AI-generated

Technical impact

A race condition in macOS (CWE-362) allows an application to read user‑sensitive data that should not be available to it. The vulnerability was remedied by adding additional validation checks. Based on the description, it is inferred that before the fix, an app that could coordinate timed operations might trigger the race to obtain protected information.

Affected Systems

Apple macOS builds older than macOS Sequoia 15.4, macOS Sonoma 14.7.5, or macOS Ventura 13.7.5 are impacted. Systems running those or earlier releases are susceptible.

Risk and Exploitability

The CVSS score of 4.7 indicates a moderate severity and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local or application‑level exploitation where a malicious app coordinates timed operations to trigger the race condition, thereby reading data that normally requires higher privileges.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade macOS to the latest patch version—macOS Sequoia 15.4, macOS Sonoma 14.7.5, or macOS Ventura 13.7.5.
  • Reboot the Mac after the upgrade to ensure that kernel components are restarted under the new validated code.
  • Remove or restrict the use of applications that handle sensitive data until the OS is updated, thereby limiting the attack surface while the patch is applied.

Generated by OpenCVE AI on April 28, 2026 at 19:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-8961 A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data.
History
Type Values Removed Values Added
Title Race Condition Allows Unauthorized Access to User‑Sensitive Data
Type Values Removed Values Added
Description A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data. A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access user-sensitive data.
Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Weaknesses CWE-362
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data.
References
Earlier changes (1)
Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Jun 18, 2026, 4:01 PM
Reserved
Jan 17, 2025, 12:00 AM

View source JSON

Updated
Nov 3, 2025, 9:10 PM

JSON

Status
Modified
Published
Mar 31, 2025, 11:15 PM
Modified
Jun 17, 2026, 8:58 AM

View source JSON

No data.

Updated
Apr 28, 2026, 7:15 PM

JSON