CVE-2025-24277
Essential information
- Published
- 01/04/2025 01:15
- Modified
- 02/04/2026 22:34
- Author
- The MITRE Corporation
- Creator
- The MITRE Corporation
- CVSS
- 7.8 HIGH (v3.1)
- CISA KEV
- No
- CWE
- CWE-276
- CVSS vector
-
—
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H—
CVSS metrics
- Access vector
- —
- Access complexity
- —
- Authentication
- —
- Confidentiality impact
- —
- Integrity impact
- —
- Availability impact
- —
- Exploitability
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
- Exploit code maturity
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- —
- Attack complexity
- —
- Attack requirements
- —
- Privileges required
- —
- User interaction
- —
- Confidentiality (V)
- —
- Confidentiality (S)
- —
- Integrity (V)
- —
- Integrity (S)
- —
- Availability (V)
- —
- Availability (S)
- —
- Exploit maturity
- —
Description
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to gain root privileges.
NVD status
- Status
- Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
- Source
- [email protected]
- NVD
- View on NVD
Affected products (CPE)
| Product | CPE |
|---|---|
| apple / macos ventura | cpe:2.3:o:apple:macos_ventura:13.7.5:*:*:*:*:*:*:* |
| apple / macos sequoia | cpe:2.3:o:apple:macos_sequoia:15.4:*:*:*:*:*:*:* |
| apple / macos sonoma | cpe:2.3:o:apple:macos_sonoma:14.7.5:*:*:*:*:*:*:* |