CVE-2025-24267

Permission Escalation Allowing Applications to Gain Root Privileges on macOS

View on CVE.org
Published Mar 31, 2025 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to gain root privileges.

Analysis

AI-generated

Technical impact

An application may exploit a permissions oversight to acquire root‑level rights, enabling it to modify system settings, access protected data, and run arbitrary code. The flaw originates from improper enforcement of file or resource permissions (CWE-276), allowing a local process to perform privileged operations.

Affected Systems

Apple macOS versions preceding Sequoia 15.4, preceding Sonoma 14.7.5, and preceding Ventura 13.7.5 are vulnerable to this permissions issue.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity for privilege escalation, yet the EPSS score of less than 1 % suggests it is unlikely to be actively exploited. The vulnerability is not listed in the CISA KEV catalog, confirming no known exploits. Attackers would need local access or the ability to run malicious software on the affected system.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to macOS Sequoia 15.4, Sonoma 14.7.5, Ventura 13.7.5 or newer to apply the permission restriction fix.
  • Restrict or disable third‑party applications that run with elevated privileges, applying the principle of least privilege.
  • Maintain macOS and applications with the latest security updates; refer to Apple Support articles 122373–122375 for patch guidance.

Generated by OpenCVE AI on April 28, 2026 at 03:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-8943 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to gain root privileges.
History
Type Values Removed Values Added
Title Permission Escalation Allowing Applications to Gain Root Privileges on macOS
Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to gain root privileges. A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to gain root privileges.
Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-276
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to gain root privileges.
References
Earlier changes (2)
Weaknesses
  • CWE-276

    Incorrect Default Permissions

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Jul 8, 2026, 2:15 PM
Reserved
Jan 17, 2025, 12:00 AM

View source JSON

Updated
Nov 3, 2025, 9:11 PM

JSON

Status
Modified
Published
Mar 31, 2025, 11:15 PM
Modified
Jun 17, 2026, 8:58 AM

View source JSON

No data.

Updated
Apr 28, 2026, 3:15 AM

JSON