CVE-2025-24170
Published: 31 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-24170 is a logic issue in file handling that affects macOS Sonoma prior to version 14.7.5 and macOS Ventura prior to version 13.7.5. Classified under CWE-276 (Incorrect Default Permissions), the vulnerability enables an app to gain root privileges. It received a CVSS v3.1 base score of 7.8 (High), reflecting its potential severity in privilege escalation scenarios. The issue was published on 2025-03-31.
The attack requires local access (AV:L) with low complexity (AC:L), no prior privileges (PR:N), and user interaction (UI:R), with no change in scope (S:U). A local attacker could exploit this by tricking a user into interacting with a malicious app, achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), ultimately resulting in root privilege escalation.
Apple mitigated the vulnerability through improved file handling in macOS Sonoma 14.7.5 and macOS Ventura 13.7.5. Practitioners should apply these updates promptly. Further details appear in Apple's security content at https://support.apple.com/en-us/122374 and https://support.apple.com/en-us/122375, as well as Full Disclosure mailing list posts at http://seclists.org/fulldisclosure/2025/Apr/10 and http://seclists.org/fulldisclosure/2025/Apr/9.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes a local privilege escalation vulnerability (CWE-276 incorrect default permissions in file handling) that allows a malicious app to gain root access on macOS, directly enabling T1068 Exploitation for Privilege Escalation.