Cyber Posture

CVE-2025-24256

Critical

Published: 31 March 2025

Published
31 March 2025
Modified
02 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0070 72.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

Security Summary

CVE-2025-24256 is a high-severity vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) stemming from insufficient bounds checks, classified under CWE-125 (Out-of-bounds Read). It affects macOS Sequoia versions prior to 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5, enabling an app to disclose kernel memory.

A remote attacker with no privileges or user interaction required can exploit this over a network vector with low complexity. Successful exploitation allows the malicious app to read kernel memory, potentially leading to high impacts on confidentiality, integrity, and availability as scored by CVSS.

Apple security advisories detail the fix through improved bounds checks in the patched versions (macOS Sequoia 15.4, Sonoma 14.7.5, Ventura 13.7.5). Relevant updates are documented at https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, and https://support.apple.com/en-us/122375, with additional full disclosure notes at http://seclists.org/fulldisclosure/2025/Apr/10 and http://seclists.org/fulldisclosure/2025/Apr/8. Security practitioners should prioritize updating affected systems.

Details

CWE(s)
CWE-125

Affected Products

apple
macos
13.0 — 13.7.5 · 14.0 — 14.7.5 · 15.0 — 15.4

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
attack.mitre.org →
Why these techniques?

Remote network exploitation (AV:N) of kernel out-of-bounds read enables initial access via public-facing components and facilitates privilege escalation plus credential access through memory disclosure.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References