CVE-2025-31243
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.
Analysis
Privilege escalation in macOS Sequoia 15.x, Sonoma 14.x, and Ventura 13.x allows local applications to gain root privileges through a permissions enforcement weakness. The vulnerability requires user interaction but no authentication, enabling malicious applications to achieve complete system compromise. Fixed in macOS Sequoia 15.6, Sonoma 14.7.7, and Ventura 13.7.7. No public exploit identified at time of analysis, with EPSS score of 0.01% (2nd percentile) indicating minimal observed exploitation likelihood.
Technical Context
This vulnerability stems from CWE-269 (Improper Privilege Management), a class of security flaw where insufficient permission checks allow unprivileged processes to perform privileged operations. In macOS, the operating system employs multiple permission frameworks including entitlements, sandboxing, and authorization services to enforce privilege boundaries. This specific issue indicates that a permissions check was either absent, improperly implemented, or could be bypassed in a system component, allowing a local application to escalate from standard user privileges to root (UID 0). The affected products span three major macOS release families: Ventura (13.x), Sonoma (14.x), and Sequoia (15.x), suggesting the vulnerable code path existed across multiple Darwin kernel and userspace framework versions. Apple's fix description 'addressed with additional restrictions' indicates the remediation involved tightening permission validation logic rather than a complete architectural change.
Affected Products
This vulnerability affects Apple macOS across three major operating system families. macOS Sequoia versions prior to 15.6 are vulnerable (cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* with version range up to excluding 15.6). macOS Sonoma versions prior to 14.7.7 are vulnerable (cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* with version range up to excluding 14.7.7). macOS Ventura versions prior to 13.7.7 are vulnerable (cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* with version range up to excluding 13.7.7). All installations running these operating system versions are potentially at risk of local privilege escalation attacks. Official vendor advisories are available at Apple Security Updates HT214149, HT214150, and HT214151.
Remediation
Vendor-released patches are available for all affected macOS versions. Organizations should upgrade to macOS Sequoia 15.6 or later for systems running the Sequoia release family, upgrade to macOS Sonoma 14.7.7 or later for Sonoma systems, and upgrade to macOS Ventura 13.7.7 or later for Ventura systems. Patches can be applied through System Settings > General > Software Update or via enterprise deployment tools such as Jamf Pro or Apple's Mobile Device Management. Detailed security content and installation instructions are available in Apple security advisories at https://support.apple.com/en-us/124149 (Sequoia), https://support.apple.com/en-us/124150 (Sonoma), and https://support.apple.com/en-us/124151 (Ventura). No workarounds are documented; patching is the only confirmed mitigation. Organizations unable to immediately patch should implement compensating controls including restricting application installation to authorized sources, enforcing Gatekeeper policies, and monitoring for unexpected privilege escalation activity through endpoint detection and response tools.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today