CVE-2025-24120 Overview
CVE-2025-24120 is a denial-of-service vulnerability in Apple macOS caused by improper management of object lifetimes. A remote attacker can leverage the flaw to trigger unexpected application termination without requiring user interaction or authentication. Apple addressed the issue by improving how affected components track and release object references.
The vulnerability is mapped to [CWE-772: Missing Release of Resource after Effective Lifetime]. Apple shipped fixes in macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3.
Critical Impact
A network-based attacker can cause unexpected termination of macOS applications without privileges or user interaction, resulting in availability loss on unpatched systems.
Affected Products
- Apple macOS Ventura prior to 13.7.3
- Apple macOS Sonoma prior to 14.7.3
- Apple macOS Sequoia prior to 15.3
Discovery Timeline
- 2025-01-27 - CVE-2025-24120 published to NVD
- 2026-04-02 - Last updated in NVD database
Technical Details for CVE-2025-24120
Vulnerability Analysis
The vulnerability stems from improper object lifetime management in a macOS component. When the affected code path processes specific input, it fails to correctly track when an underlying object should be released or remain valid. This mismanagement leads to inconsistent state that the runtime cannot recover from, terminating the affected application.
The flaw is reachable over the network and requires no authentication or user interaction. Successful exploitation impacts availability only, with no direct effect on confidentiality or integrity. The CWE-772 classification indicates the root cause is a missing release of a resource after its effective lifetime, which can manifest as a dangling reference or an unreleased handle that the runtime later acts upon.
Root Cause
The defect resides in code that allocates and tracks objects across asynchronous or multi-step processing. The original implementation did not consistently release the object after its effective lifetime ended, allowing the affected component to operate on inconsistent state. Apple's advisory notes the fix was implemented through "improved management of object lifetimes," indicating reference counting or ownership semantics were corrected in the patched releases.
Attack Vector
An attacker delivers crafted network input to a vulnerable macOS service or application. Processing the input triggers the object lifetime defect and forces unexpected termination. Because the attack vector is network-based with no privileges required, exposed macOS endpoints handling untrusted input are most at risk. No public proof-of-concept exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical details from independent researchers were published in the Full Disclosure mailing list entries dated January 15–17, 2025. See the Full Disclosure January 15, 2025 archive for additional context.
Detection Methods for CVE-2025-24120
Indicators of Compromise
- Repeated unexpected termination of macOS system or user applications, particularly after processing network input from untrusted sources.
- Crash reports in /Library/Logs/DiagnosticReports/ referencing the affected component with object release or use-after-release signatures.
- Anomalous restart cycles for launchd-managed services on macOS endpoints below the patched versions.
Detection Strategies
- Inventory macOS endpoints by build number and flag any system below 13.7.3, 14.7.3, or 15.3 as exposed.
- Correlate application crash telemetry with network connection events to identify externally triggered terminations.
- Hunt across endpoint telemetry for repeated ReportCrash invocations tied to network-facing macOS processes.
Monitoring Recommendations
- Forward macOS unified logs and DiagnosticReports to a centralized SIEM for crash pattern analysis.
- Alert on clusters of application terminations affecting multiple macOS hosts within short time windows, which may indicate active probing.
- Track Apple security advisories 122068, 122069, and 122070 for related component disclosures.
How to Mitigate CVE-2025-24120
Immediate Actions Required
- Update macOS Ventura systems to 13.7.3, Sonoma systems to 14.7.3, and Sequoia systems to 15.3 or later.
- Prioritize patching for macOS endpoints exposed to untrusted networks or handling external content.
- Validate patch deployment by confirming the system build version through sw_vers after update.
Patch Information
Apple released fixes in macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3. Patch details are documented in Apple Support Document #122068, Apple Support Document #122069, and Apple Support Document #122070.
Workarounds
- Restrict inbound network exposure for macOS endpoints using host-based firewall rules until patches are deployed.
- Limit processing of untrusted content on unpatched macOS systems, especially in shared or server roles.
- Enable automatic macOS updates to reduce exposure windows for future Apple security advisories.
# Verify macOS version is patched
sw_vers -productVersion
# Trigger a software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
