CVE-2025-24119
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
Analysis
Sandbox escape and privilege escalation in macOS 13.7.x through 15.2.x allow local authenticated users to execute arbitrary code outside application sandboxes or gain elevated privileges via state management flaws. Apple patched this in macOS Ventura 13.7.7, Sonoma 14.7.7, and Sequoia 15.3. With EPSS at 0.02% (5th percentile) and no public exploit identified at time of analysis, real-world risk remains low despite the high CVSS score, though local attackers with existing user-level access could leverage this for post-exploitation privilege escalation.
Technical Context
This vulnerability stems from CWE-269 (Improper Privilege Management), where macOS state management logic fails to properly enforce sandbox boundaries and privilege separation between applications. Apple's sandbox architecture (App Sandbox) relies on kernel-level mandatory access controls to isolate applications from system resources and other apps. State management bugs can create race conditions or logic flaws where privilege checks are bypassed during state transitions. The affected CPE strings indicate widespread impact across macOS Ventura (13.x), Sonoma (14.x), and Sequoia (15.x) releases prior to their respective 13.7.7, 14.7.7, and 15.3 versions. Apple's fix through 'improved state management' suggests remediation of synchronization or validation logic in privilege enforcement code paths.
Affected Products
Apple macOS is affected across three major release branches. macOS Sequoia versions prior to 15.3, macOS Sonoma versions prior to 14.7.7, and macOS Ventura versions prior to 13.7.7 all contain the vulnerable state management implementation. The vulnerability impacts all deployment configurations of these operating system versions. Official vendor advisories are available at https://support.apple.com/en-us/124150 (Sequoia 15.3), https://support.apple.com/en-us/124151 (Sonoma 14.7.7), and https://support.apple.com/en-us/122068 (Ventura 13.7.7).
Remediation
Vendor-released patches are available: upgrade to macOS Sequoia 15.3, macOS Sonoma 14.7.7, or macOS Ventura 13.7.7 depending on your major version branch. Apple addresses this through operating system updates distributed via System Preferences/Settings > General > Software Update or through enterprise management tools. No workarounds are documented for this vulnerability as it requires kernel-level state management fixes. Organizations should prioritize patching systems where local user access is shared among multiple users or where endpoints process untrusted content that could be chained with this sandbox escape. Full security release notes and update instructions are available in Apple's support documents at the reference URLs above.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today