CVE-2025-24136: Apple macOS Path Traversal Vulnerability

CVE-2025-24136 Overview

CVE-2025-24136 is a symlink validation flaw in Apple macOS that allows a malicious application to create symbolic links pointing to protected regions of the disk. Apple addressed the issue through improved validation of symlinks in macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3. The weakness is categorized under [CWE-59] (Improper Link Resolution Before File Access, also known as a Link Following vulnerability). Exploitation requires local access and user interaction, limiting remote attack scenarios but creating meaningful risk on multi-user or shared endpoints.

Critical Impact
A malicious app running locally can create symlinks into protected disk regions, undermining macOS file system integrity protections and enabling downstream tampering or data access.

Affected Products

Apple macOS Ventura prior to 13.7.3
Apple macOS Sonoma prior to 14.7.3
Apple macOS Sequoia prior to 15.3

Discovery Timeline

2025-01-27 - CVE-2025-24136 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24136

Vulnerability Analysis

The vulnerability is a symlink attack (Link Following, [CWE-59]) in macOS file handling routines. A sandboxed or standard-user process can create symbolic links that resolve into directories normally protected by macOS access controls such as System Integrity Protection (SIP) and Transparency, Consent, and Control (TCC). Because the operating system did not sufficiently validate the target of a symlink before performing privileged file operations, a malicious application could redirect those operations toward sensitive paths. The practical impact is limited confidentiality and integrity exposure, with no direct availability loss. Apple's advisory documents the fix as improved validation of symlinks.

Root Cause

The root cause is improper link resolution before file access. Privileged file operations followed attacker-controlled symlinks instead of verifying that the resolved target resided within an allowed path. This classic time-of-use trust gap allowed symlink redirection into protected regions.

Attack Vector

Exploitation requires local code execution and user interaction, for example installing or running a malicious application. The attacker-controlled process creates a symlink in a writable location and relies on a subsequent privileged operation to traverse the link. The attack does not require elevated privileges to begin, but the targeted file operation must have the authority to touch the protected region. See the Apple Support Document #122070 and the Full Disclosure Post January 15, 2025 for additional context.

Detection Methods for CVE-2025-24136

Indicators of Compromise

Creation of symbolic links by non-system processes that resolve into SIP-protected or TCC-protected paths such as /System, /Library/Apple, or ~/Library/Application Support subdirectories owned by other apps.
Unexpected symlink(2) or symlinkat(2) syscalls originating from recently installed third-party applications or sandboxed binaries.
File write or metadata change events in protected regions that correlate with a prior symlink creation by a user-space process.

Detection Strategies

Monitor Endpoint Security framework events (ES_EVENT_TYPE_NOTIFY_LINK, ES_EVENT_TYPE_NOTIFY_CREATE) to flag symlinks whose targets fall under protected directory prefixes.
Correlate symlink creation events with subsequent file operations against the symlink's target path to identify link-following behavior.
Baseline legitimate application behavior and alert on binaries that begin issuing symlink calls outside their normal container paths.

Monitoring Recommendations

Ingest macOS Unified Logs and Endpoint Security telemetry into a centralized analytics platform for retroactive hunting.
Track macOS build versions across the fleet and alert when hosts remain on vulnerable versions below 13.7.3, 14.7.3, or 15.3.
Review installed application inventories for low-reputation or recently side-loaded apps that could abuse local symlink primitives.

How to Mitigate CVE-2025-24136

Immediate Actions Required

Update macOS endpoints to macOS Ventura 13.7.3, macOS Sonoma 14.7.3, or macOS Sequoia 15.3 or later as described in Apple's advisories.
Audit installed applications and remove any untrusted or unsigned software that does not require administrative justification.
Restrict standard users from installing arbitrary applications on managed macOS fleets via MDM policy.

Patch Information

Apple fixed CVE-2025-24136 by implementing improved validation of symlinks. Patched builds are documented in Apple Support Document #122068, Apple Support Document #122069, and Apple Support Document #122070. Administrators should deploy these updates through their mobile device management (MDM) platform and confirm installation using sw_vers.

Workarounds

No official workaround exists; patching is the only supported remediation.
Reduce risk by enforcing application allow-listing and keeping System Integrity Protection (SIP) enabled on all macOS systems.
Limit the use of local administrator accounts and require signed, notarized applications via Gatekeeper policy.

bash

# Verify macOS version meets the patched baseline
sw_vers -productVersion

# Trigger software update check and install available updates
sudo softwareupdate --install --all --restart