Security readout for executives and security teams
Plain-English summary
CVE-2025-24165 is an Apple macOS permissions issue that could let an app cause unexpected system termination. The main business impact is availability: affected Macs may crash or stop unexpectedly. Apple states the issue is fixed in macOS Sequoia 15.4, Sonoma 14.7.5, and Ventura 13.7.5.
Executive priority
Treat as a routine-to-important macOS availability fix. Patch through normal endpoint management, prioritizing laptops and systems exposed to untrusted software. No source provided evidence of active exploitation, but the fix is available and should be applied.
Technical view
Apple describes this as a permissions issue addressed with additional restrictions. CVSS 3.1 is 5.5 with local attack vector, low complexity, no privileges required, user interaction required, and high availability impact. The CVE maps to CWE-284, Improper Access Control.
Likely exposure
Exposure is limited to Apple macOS systems running versions before Sequoia 15.4, Sonoma 14.7.5, or Ventura 13.7.5. The vulnerability requires a local app and user interaction, reducing broad remote exposure but still relevant for managed fleets.
Exploitation context
The provided sources do not indicate active exploitation, public exploit availability, or CISA KEV listing. The impact described is unexpected system termination, not data theft or privilege escalation. Risk is higher where users can install or run untrusted applications.
Researcher notes
Apple provides limited technical detail beyond a permissions issue and additional restrictions. The CVSS vector indicates local execution with user interaction and availability-only impact. Avoid assuming code execution, privilege escalation, or remote exploitability from the available sources.
Mitigation direction
- Update macOS Sequoia systems to 15.4 or later.
- Update macOS Sonoma systems to 14.7.5 or later.
- Update macOS Ventura systems to 13.7.5 or later.
- Prioritize systems used by high-risk users or allowing untrusted apps.
- If updates are delayed, follow Apple guidance and restrict untrusted application execution.
Validation and detection
- Inventory macOS endpoints and identify OS major version.
- Confirm Sequoia endpoints are on 15.4 or later.
- Confirm Sonoma endpoints are on 14.7.5 or later.
- Confirm Ventura endpoints are on 13.7.5 or later.
- Review endpoint controls limiting execution of untrusted applications.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-24165 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/122373CVE reference, apple
- https://support.apple.com/en-us/122374CVE reference, apple
- https://support.apple.com/en-us/122375CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.