CVE-2025-24093: Apple macOS Auth Bypass Vulnerability

CVE-2025-24093 Overview

CVE-2025-24093 is a permissions vulnerability in Apple macOS that allows an application to access removable volumes without user consent. The flaw stems from insufficient access controls on mounted external storage and is categorized under [CWE-276] Incorrect Default Permissions. Apple addressed the issue by adding restrictions in macOS Sequoia 15.4, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3. The vulnerability affects the Transparency, Consent, and Control (TCC) model that macOS uses to gate access to user data and external media.

Critical Impact
A malicious or compromised application can read data from connected USB drives, SD cards, and other removable media without triggering the standard user consent prompt.

Affected Products

Apple macOS Ventura versions prior to 13.7.3
Apple macOS Sonoma versions prior to 14.7.3
Apple macOS Sequoia versions prior to 15.4

Discovery Timeline

2025-01-27 - CVE-2025-24093 published to the National Vulnerability Database (NVD)
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2025-24093

Vulnerability Analysis

The vulnerability resides in how macOS enforces consent prompts for processes that attempt to read data on removable volumes. Starting with macOS Ventura, Apple required applications to obtain explicit user approval through TCC before accessing files on external media. CVE-2025-24093 bypasses that control, letting an app enumerate and read files on mounted USB drives, SD cards, or external SSDs without surfacing a consent dialog.

The issue is classified as [CWE-276] Incorrect Default Permissions. Apple's advisory states the fix involved "additional restrictions," indicating the underlying entitlement check or filesystem path filter granted broader access than intended. The flaw undermines a privacy boundary that users and enterprises rely on to limit data exfiltration from removable storage.

Root Cause

The root cause is a missing or incomplete permission check in the subsystem that brokers access to removable volume mount points. macOS normally evaluates a process's TCC authorization against the volume's classification before returning directory contents. In affected versions, that evaluation can be skipped or satisfied by an entitlement the application should not be granted by default.

Attack Vector

An attacker delivers a malicious application or compromises an existing one with file-system access entitlements. When the user inserts a removable volume, the app reads its contents silently. The attacker then exfiltrates sensitive documents, credentials, backup archives, or cryptographic key material from the external media. No additional user interaction is required beyond running the malicious app and having a volume mounted.

No public proof-of-concept code has been released for CVE-2025-24093. See Apple Security Advisory 122069 and Apple Security Advisory 122070 for vendor technical details.

Detection Methods for CVE-2025-24093

Indicators of Compromise

Processes opening file descriptors against paths under /Volumes/ without a corresponding TCC prompt event in tccd logs.
Unsigned or recently installed applications enumerating directories on attached USB or SD media shortly after mount events from diskarbitrationd.
Outbound network transfers correlated in time with read activity against removable volume mount points.

Detection Strategies

Collect Endpoint Security Framework ES_EVENT_TYPE_NOTIFY_OPEN and ES_EVENT_TYPE_NOTIFY_MOUNT events and alert when non-Finder processes read from newly mounted external volumes.
Inspect Unified Logs for tccd decisions related to kTCCServiceSystemPolicyRemovableVolumes and flag processes that bypass prompting.
Baseline which signed applications legitimately access removable media in your environment, then alert on deviations.

Monitoring Recommendations

Forward macOS endpoint telemetry, including process execution and file access events, to a centralized analytics platform for correlation.
Monitor for installation of unsigned or ad-hoc signed applications that request broad file-system entitlements.
Track macOS build versions across the fleet to identify endpoints still running unpatched releases of Ventura, Sonoma, or Sequoia.

How to Mitigate CVE-2025-24093

Immediate Actions Required

Update affected endpoints to macOS Sequoia 15.4, macOS Sonoma 14.7.3, or macOS Ventura 13.7.3 or later.
Audit installed third-party applications for unexpected file-system or removable-volume entitlements and remove unneeded software.
Restrict use of removable media on managed Macs through Mobile Device Management (MDM) policy until patches are deployed.

Patch Information

Apple released fixes in macOS Ventura 13.7.3, macOS Sonoma 14.7.3, and macOS Sequoia 15.4. Patch details are documented in Apple Security Advisory 122069, Apple Security Advisory 122070, and Apple Security Advisory 122373. Apply the appropriate update through Software Update or via MDM-managed software update commands.

Workarounds

Use MDM configuration profiles to block mounting of USB mass storage and SD media on systems that cannot be patched immediately.
Limit application installation to vetted sources by enforcing Gatekeeper settings that allow only App Store and identified developer software.
Encrypt removable volumes with FileVault or APFS encryption so that unauthorized reads return ciphertext without the user's passphrase.

bash

# Verify the installed macOS build meets the patched version
sw_vers -productVersion

# Trigger software update check and install available updates
sudo softwareupdate --install --all --restart