CVE-2025-24242 — Link Following in Apple Macos

CWE-59 — Link Following CWE-200 — Sensitive Information Exposure3 documents3 sources

Severity

4.4MEDIUMNVD

EPSS

0.1%

top 68.50%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apple Macos Apple Macos Sequoia

Timeline

PublishedMar 31

Latest updateApr 1

Description

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app with root privileges may be able to access private information.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 0.8 | Impact: 3.6

Affected Packages2 packages

▶Appleapple/macos_sequoia15.4

▶NVDapple/macos< 15.4

🔴Vulnerability Details

GHSA

GHSA-892g-82wc-7r8q: This issue was addressed with improved handling of symlinks↗2025-04-01

▶

📋Vendor Advisories

Apple

CVE-2025-24242: macOS Sequoia 15.4↗2025-03-31

▶