CVE-2025-31247

Improper Access Control in macOS State Management Enables File System Access

View on CVE.org
Published May 12, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An attacker may gain access to protected parts of the file system.

Analysis

AI-generated

Technical impact

A logic flaw in macOS state management permits an attacker to gain access to protected parts of the file system, allowing the reading or modification of data that should be isolated from the attacker.

Affected Systems

Apple macOS releases older than Sequoia 15.5, Sonoma 14.7.6, and Ventura 13.7.6 are affected; those older versions are at risk until updated to the stated fixed releases.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, yet the EPSS score of <1% signals a low but non‑zero chance of exploitation. The vulnerability is not catalogued in CISA KEV and no public exploits have been reported. The attack vector is inferred to be local or remote, depending on how the logic flaw is triggered, but the CVE description does not specify the precise exploitation path.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update macOS to Sequoia 15.5 or later, Sonoma 14.7.6 or later, or Ventura 13.7.6 or later
  • Enable automatic software updates to receive security patches promptly
  • Monitor Apple support for new advisories or updated security guidance

Generated by OpenCVE AI on April 28, 2026 at 18:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-14617 A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An attacker may gain access to protected parts of the file system.
History
Type Values Removed Values Added
Title Improper Access Control in macOS State Management Enables File System Access
Type Values Removed Values Added
Description A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An attacker may gain access to protected parts of the file system. A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An attacker may gain access to protected parts of the file system.
Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An attacker may gain access to protected parts of the file system.
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Apr 2, 2026, 6:21 PM
Reserved
Mar 27, 2025, 4:13 PM

View source JSON

Updated
Nov 3, 2025, 7:52 PM

JSON

Status
Modified
Published
May 12, 2025, 10:15 PM
Modified
Jun 17, 2026, 9:10 AM

View source JSON

No data.

Updated
Apr 28, 2026, 7:00 PM

JSON