CVE-2025-30431

Vulnerability

The issue is an insufficient check in macOS that allows a malicious app to access private information. The vulnerability affects macOS Sequoia before version 15.4, macOS Sonoma before version 14.7.5, and macOS Ventura before version 13.7.5 [1][2][3]. The code path is reachable by any app installed on the system.

Exploitation

An attacker must have the ability to run a malicious app on the target macOS system. No additional privileges beyond app execution are required. The app can then exploit the insufficient check to access private information.

Impact

A successful exploit allows the malicious app to access private information, which may include sensitive user data. The app may be able to read data outside its sandbox, leading to disclosure of confidential information.

Mitigation

Apple has addressed the issue by improving checks. The fix is included in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5, released on March 31, 2025 [1][2][3]. Users should update to these or later versions. No workaround is available.