What is the CVSS score of CVE-2025-31243?

CVE-2025-31243 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2025-31243?

CVE-2025-31243 is a local privilege escalation in macOS Sequoia, Sonoma, and Ventura that allows installed applications to gain root access through a permissions enforcement flaw, requiring only user…

How to fix or mitigate CVE-2025-31243?

Within 24 hours: Inventory all macOS endpoints running Sequoia 15.x, Sonoma 14.x, or Ventura 13.x and flag for priority patching. Within 7 days: Deploy macOS Sequoia 15.6, Sonoma 14.7.7, or Ventura 13.7.7 respectively to all affected systems via MDM. Within 30 days: Verify 100% patch compliance and audit application installations on previously unpatched devices for suspicious or unauthorized software.

macOS CVE-2025-31243

HIGH

Improper Privilege Management (CWE-269)

2025-07-30 product-security@apple.com

Apple macOS Privilege Escalation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

HIGH 7.8

DescriptionCVE.org

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.

AnalysisAI

Privilege escalation in macOS Sequoia 15.x, Sonoma 14.x, and Ventura 13.x allows local applications to gain root privileges through a permissions enforcement weakness. The vulnerability requires user interaction but no authentication, enabling malicious applications to achieve complete system compromise. Fixed in macOS Sequoia 15.6, Sonoma 14.7.7, and Ventura 13.7.7. No public exploit identified at time of analysis, with EPSS score of 0.01% (2nd percentile) indicating minimal observed exploitation likelihood.

Technical ContextAI

This vulnerability stems from CWE-269 (Improper Privilege Management), a class of security flaw where insufficient permission checks allow unprivileged processes to perform privileged operations. In macOS, the operating system employs multiple permission frameworks including entitlements, sandboxing, and authorization services to enforce privilege boundaries. This specific issue indicates that a permissions check was either absent, improperly implemented, or could be bypassed in a system component, allowing a local application to escalate from standard user privileges to root (UID 0). The affected products span three major macOS release families: Ventura (13.x), Sonoma (14.x), and Sequoia (15.x), suggesting the vulnerable code path existed across multiple Darwin kernel and userspace framework versions. Apple's fix description 'addressed with additional restrictions' indicates the remediation involved tightening permission validation logic rather than a complete architectural change.

RemediationAI

Vendor-released patches are available for all affected macOS versions. Organizations should upgrade to macOS Sequoia 15.6 or later for systems running the Sequoia release family, upgrade to macOS Sonoma 14.7.7 or later for Sonoma systems, and upgrade to macOS Ventura 13.7.7 or later for Ventura systems. Patches can be applied through System Settings > General > Software Update or via enterprise deployment tools such as Jamf Pro or Apple's Mobile Device Management. Detailed security content and installation instructions are available in Apple security advisories at https://support.apple.com/en-us/124149 (Sequoia), https://support.apple.com/en-us/124150 (Sonoma), and https://support.apple.com/en-us/124151 (Ventura). No workarounds are documented; patching is the only confirmed mitigation. Organizations unable to immediately patch should implement compensating controls including restricting application installation to authorized sources, enforcing Gatekeeper policies, and monitoring for unexpected privilege escalation activity through endpoint detection and response tools.