CVE-2025-24241 — Improper Access Control in Apple Macos

CWE-284 — Improper Access ControlCWE-416 — Use After Free6 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.6%
top 31.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Apple MacosApple Macos SequoiaApple Macos Sonoma+3 more
Timeline
PublishedMar 31
Latest updateApr 1

Description

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to trick a user into copying sensitive data to the pasteboard.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages7 packages

▶Appleapple/macos_sonoma14.7.5
▶Appleapple/macos_ventura13.7.5
▶CVEListV5apple/macos< 13.7.5+2
▶NVDapple/macos13.0 — 13.7.5+2

🔴Vulnerability Details

1
GHSA
GHSA-g632-x89p-c4m6: A configuration issue was addressed with additional restrictions↗2025-04-01
▶

📋Vendor Advisories

4
Apple
CVE-2025-24241: macOS Sonoma 14.7.5↗2025-03-31
▶
Apple
CVE-2025-24241: macOS Ventura 13.7.5↗2025-03-31
▶
Apple
CVE-2025-24241: macOS Sequoia 15.4↗2025-03-31
▶
Microsoft
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.↗2020-08-11
▶