CVE-2025-24276

macOS Private Information Disclosure via Vulnerable Code

View on CVE.org
Published Mar 31, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access private information.

Analysis

AI-generated

Technical impact

A vulnerability in macOS allowed a malicious application to read private data. The flaw was mitigated by removing the vulnerable code, but prior to that, an attacker could leverage an exposed interface to access sensitive information, resulting in disclosure of confidential data. This weakness aligns with CWE‑200, where information is revealed to an unauthorized party.

Affected Systems

The flaw affected Apple macOS versions prior to Sequoia 15.4, Sonoma 14.7.5, and Ventura 13.7.5. All releases newer than these contain the fix.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate risk. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a malicious local application that the user installs; based on the description, it is inferred that the attacker could exploit an exposed interface to read protected data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update macOS to a version where the vulnerability is fixed (Sequoia 15.4 or later, Sonoma 14.7.5 or later, Ventura 13.7.5 or later).
  • Ensure Gatekeeper is enabled to prevent installation of unsigned applications.
  • Configure MDM or macOS supervision to require notarization for all applications, blocking execution of unverified local code.

Generated by OpenCVE AI on April 28, 2026 at 19:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-8929 This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to access private information.
History
Type Values Removed Values Added
Title macOS Private Information Disclosure via Vulnerable Code
Type Values Removed Values Added
Description This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to access private information. This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access private information.
Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to access private information.
References
Earlier changes (1)
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Apr 2, 2026, 6:11 PM
Reserved
Jan 17, 2025, 12:00 AM

View source JSON

Updated
Nov 3, 2025, 9:12 PM

JSON

Status
Modified
Published
Mar 31, 2025, 11:15 PM
Modified
Jun 17, 2026, 8:58 AM

View source JSON

No data.

Updated
Apr 28, 2026, 7:15 PM

JSON