What is the CVSS score of CVE-2025-24284?

CVE-2025-24284 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS Sequoia are affected by CVE-2025-24284?

Apple macOS Sequoia versions prior to 15.4 contain a sandbox escape vulnerability (CVE-2025-24284, CVSS 8.8) that allows locally installed applications to bypass App Sandbox restrictions and perform…. A patch is available.

How to fix or mitigate CVE-2025-24284?

Within 24 hours: Inventory all macOS Sequoia systems and identify those running versions prior to 15.4. Within 7 days: Begin phased deployment of macOS Sequoia 15.4 or later patch; prioritize high-value systems and security-sensitive endpoints. Within 30 days: Complete deployment and verify all affected systems have received the security update.

macOS Sequoia CVE-2025-24284

EUVD-2025-210114 HIGH

Protection Mechanism Failure (CWE-693)

2026-06-11 apple

GHSA-crw2-cm3v-9p9w

Authentication Bypass Apple

8.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Requires a low-privileged sandboxed process on the local system with no user interaction; successful escape changes scope and yields full CIA impact on the host.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 21:30 vuln.today

CVSS changed

Jun 11, 2026 - 20:22 NVD

8.8 (HIGH)

Patch available

Jun 11, 2026 - 20:01 EUVD

CVE Published

Jun 11, 2026 - 18:47 cve.org

HIGH 8.8

CVE Published

Jun 11, 2026 - 18:47 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox.

AnalysisAI

Sandbox escape in Apple macOS prior to Sequoia 15.4 allows a locally installed application to break out of the App Sandbox and perform unauthorized actions outside its confinement boundary. Apple addressed the issue with improved checks; no public exploit identified at time of analysis, though SSVC rates technical impact as total.

Technical ContextAI

The flaw resides in the macOS App Sandbox, a kernel-enforced mandatory access control layer built on Apple's Seatbelt/TrustedBSD framework that restricts an application's access to files, IPC, network, and system resources via entitlement-driven profiles. The CWE-693 (Protection Mechanism Failure) classification indicates the sandbox's enforcement checks were incomplete or bypassable, allowing an in-sandbox process to reach resources its profile should have denied. The CPE cpe:2.3:a:apple:macos covers macOS broadly, with the EUVD record narrowing the affected range to all versions below 15.4.

RemediationAI

Vendor-released patch: macOS Sequoia 15.4 - upgrade affected Macs to 15.4 or later via System Settings > General > Software Update, referencing Apple's advisory at https://support.apple.com/en-us/122373. For fleets that cannot immediately upgrade, compensating controls include restricting installation of untrusted applications via Gatekeeper set to App Store only (trade-off: blocks legitimate developer-signed apps), enforcing notarization checks and removing quarantine-bypass tooling, and using MDM configuration profiles to constrain which apps can be launched (trade-off: administrative overhead and potential workflow disruption). Endpoint detection rules should watch for sandboxed processes performing unexpected filesystem, IPC, or entitlement-related operations.