{"id":"CVE-2025-24255","state":"PUBLISHED","title":"A file access issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to break ","description":"A file access issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to break out of its sandbox.","publishedAt":"2025-03-31T22:24:04.560Z","updatedAt":"2026-04-02T18:24:13.595Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apple","products":["Apple macOS"],"affected":[{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"13.7.5","versionType":"custom"},{"version":"0","status":"affected","lessThan":"14.7.5","versionType":"custom"},{"version":"0","status":"affected","lessThan":"15.4","versionType":"custom"}]}],"references":["https://support.apple.com/en-us/122373","https://support.apple.com/en-us/122374","https://support.apple.com/en-us/122375","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/9","http://seclists.org/fulldisclosure/2025/Apr/8"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/24xxx/CVE-2025-24255.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-24255","state":"PUBLISHED","datePublished":"2025-03-31T22:24:04.560Z","dateUpdated":"2026-04-02T18:24:13.595Z","assignerShortName":"apple","assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateReserved":"2025-01-17T00:00:45.013Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A file access issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to break out of its sandbox."}],"affected":[{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"13.7.5","versionType":"custom"},{"version":"0","status":"affected","lessThan":"14.7.5","versionType":"custom"},{"version":"0","status":"affected","lessThan":"15.4","versionType":"custom"}]}],"references":[{"url":"https://support.apple.com/en-us/122373"},{"url":"https://support.apple.com/en-us/122374"},{"url":"https://support.apple.com/en-us/122375"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"An app may be able to break out of its sandbox"}]}],"providerMetadata":{"shortName":"apple","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateUpdated":"2026-04-02T18:24:13.595Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.4,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-01T15:38:55.222571Z","id":"CVE-2025-24255","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","type":"CWE","lang":"en","description":"CWE-20 Improper Input Validation"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-01T15:46:02.873Z"}},{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2025/Apr/10"},{"url":"http://seclists.org/fulldisclosure/2025/Apr/9"},{"url":"http://seclists.org/fulldisclosure/2025/Apr/8"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T21:11:13.331Z"}}]}}}