CVE-2025-24101: Apple macOS Information Disclosure Flaw

CVE-2025-24101 Overview

CVE-2025-24101 is a sensitive information disclosure vulnerability in Apple macOS. Apple addressed the issue with improved redaction of sensitive information in macOS Sequoia 15.3. A local application may be able to access user-sensitive data on affected systems. The weakness is classified under [CWE-922] (Insecure Storage of Sensitive Information).

The vulnerability requires local access and user interaction, and it impacts confidentiality without affecting integrity or availability. No public exploit is known, and CISA has not added the flaw to the Known Exploited Vulnerabilities catalog.

Critical Impact
A locally installed application can read user-sensitive data that should have been redacted, exposing private information stored by the operating system.

Affected Products

Apple macOS versions prior to Sequoia 15.3
Systems where third-party apps process or display OS-redacted data
macOS endpoints running unpatched Sequoia builds

Discovery Timeline

2025-01-27 - CVE-2025-24101 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24101

Vulnerability Analysis

The vulnerability resides in macOS logic that redacts sensitive information before exposing data to applications. Insufficient redaction allows an installed application to observe user-sensitive fields that should have been masked. The issue maps to [CWE-922] Insecure Storage of Sensitive Information.

Exploitation requires local execution context on the target Mac and some form of user interaction, such as running or launching an application. The confidentiality impact is high, while integrity and availability are unaffected. Apple did not publish detailed technical internals in the advisory beyond noting improved redaction as the fix.

Root Cause

The root cause is inadequate redaction of sensitive information by macOS prior to exposing data through interfaces reachable by locally installed applications. Apple resolved the flaw by strengthening the redaction logic in macOS Sequoia 15.3. See the Apple Support Article for the vendor description.

Attack Vector

An attacker must first achieve local code execution on the Mac, typically by convincing a user to install or run a malicious application. Once running, the application queries or observes data paths where macOS should have redacted user-sensitive content. Because redaction is incomplete, the application harvests data such as user identifiers or other private fields. Additional technical discussion is available on the Full Disclosure Mailing List Post.

No verified proof-of-concept code has been published, so this article describes the mechanism in prose only.

Detection Methods for CVE-2025-24101

Indicators of Compromise

Unsigned or unnotarized applications reading system metadata or log endpoints that expose user-scoped fields
Unexpected access by non-Apple binaries to interfaces that normally return redacted values
macOS endpoints reporting a build older than Sequoia 15.3 in inventory data

Detection Strategies

Inventory macOS endpoints and flag any host running a version prior to Sequoia 15.3
Correlate application installation events with subsequent access to system information APIs
Review Endpoint Security framework telemetry for unusual data reads from newly installed apps

Monitoring Recommendations

Alert on installation of unsigned applications on production Macs
Track process launches that query system metadata immediately after install
Maintain a baseline of applications permitted to access user-sensitive OS services

How to Mitigate CVE-2025-24101

Immediate Actions Required

Update all affected Macs to macOS Sequoia 15.3 or later
Restrict installation of untrusted third-party applications through MDM policy
Audit currently installed applications for unknown or unsigned binaries
Enforce Gatekeeper and notarization requirements on managed endpoints

Patch Information

Apple fixed CVE-2025-24101 in macOS Sequoia 15.3 through improved redaction of sensitive information. Administrators should deploy the update through Apple Software Update or their MDM platform. Refer to the Apple Support Article for the full list of components addressed in the release.

Workarounds

Limit local user privileges to prevent installation of arbitrary applications
Deploy allowlisting to block execution of unapproved macOS binaries
Isolate Macs handling sensitive data from general-purpose app installation until patched

bash

# Verify macOS version meets the patched build
sw_vers -productVersion

# Trigger software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart