CVE-2025-24239: Apple macOS Information Disclosure Flaw

CVE-2025-24239 Overview

CVE-2025-24239 is a downgrade vulnerability in Apple macOS that allows an application to access protected user data. Apple addressed the issue in macOS Sequoia 15.4 by adding code-signing restrictions that prevent components from being replaced with older, less-restrictive versions. The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). A malicious app installed on an affected system can bypass Transparency, Consent, and Control (TCC) protections and read data that should remain private.

Critical Impact
An application with low privileges can read protected user data by downgrading a signed component to a version without current code-signing enforcement.

Affected Products

Apple macOS versions prior to macOS Sequoia 15.4
macOS installations where affected signed components can be replaced with older builds
Applications and workflows that rely on TCC-protected resources on unpatched macOS hosts

Discovery Timeline

2025-03-31 - CVE-2025-24239 published to the National Vulnerability Database
2025-03-31 - Apple releases macOS Sequoia 15.4 addressing the issue
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-24239

Vulnerability Analysis

The vulnerability is a code-signing downgrade issue in macOS. An attacker with a foothold on the system can substitute a current, hardened binary or bundle with an older, validly signed version whose code-signing restrictions are weaker. Because the older version still passes signature validation, the operating system accepts it and applies its weaker access controls.

The practical outcome is a bypass of runtime protections that gate access to user data. Files, directories, and interfaces normally protected by Transparency, Consent, and Control (TCC) become reachable from an app that would otherwise be denied. This maps to [CWE-200], information exposure to an unauthorized actor.

Exploitation requires the ability to run code on the target macOS host and to place an older signed component in a location the loader will use. The result is confidentiality impact on user data without altering system integrity or availability.

Root Cause

The root cause is insufficient enforcement of version-based code-signing constraints. macOS accepted an older validly signed component and did not reject it on the basis of its outdated signing requirements. Apple's fix introduces additional code-signing restrictions that block the downgrade path.

Attack Vector

A local application on macOS triggers the flaw by loading or invoking the downgraded component. The referenced disclosure covers the class of downgrade abuse against Apple-signed code. See the Apple Support Article and the Full Disclosure Security Report for vendor and community technical details.

// No verified public proof-of-concept code is available.
// Refer to the vendor advisory and Full Disclosure post for technical details.

Detection Methods for CVE-2025-24239

Indicators of Compromise

Presence of older Apple-signed binaries, frameworks, or bundles in user-writable or application-adjacent paths on macOS hosts.
Unexpected reads of TCC-protected locations such as ~/Library/Application Support, ~/Library/Messages, or Photos and Contacts databases by non-Apple applications.
Application launches whose code-signing team identifier or version does not match the currently installed macOS Sequoia baseline.

Detection Strategies

Inventory installed Apple-signed components with codesign -dvvv and compare bundle versions against the expected macOS Sequoia 15.4 baseline.
Alert on process launches that load Apple binaries from non-standard paths outside /System, /Library, or /Applications.
Correlate TCC prompt suppression or absence with subsequent access to protected user directories.

Monitoring Recommendations

Enable Endpoint Security framework telemetry for ES_EVENT_TYPE_NOTIFY_EXEC and file-open events targeting TCC-protected paths.
Ship macOS Unified Log events for com.apple.TCC and amfi subsystems to a central log platform for retention and hunting.
Baseline signed component versions across the fleet and alert on drift where older signed builds appear after a macOS upgrade.

How to Mitigate CVE-2025-24239

Immediate Actions Required

Upgrade all macOS endpoints to macOS Sequoia 15.4 or later, as specified in the Apple Support Article.
Audit installed applications for unsigned or non-notarized bundles that could be used to stage a downgraded component.
Restrict local administrative rights on user endpoints to reduce the ability of an attacker to place older signed binaries.

Patch Information

Apple fixed CVE-2025-24239 in macOS Sequoia 15.4 by adding code-signing restrictions that prevent the affected downgrade. Administrators should deploy the update through Apple Software Update, MDM, or the Automated Device Enrollment workflow. Confirm patch state by verifying the OS build reports macOS Sequoia 15.4 or newer with sw_vers.

Workarounds

No official workaround is published by Apple; the vendor guidance is to install macOS Sequoia 15.4.
As a compensating control, enforce Gatekeeper at its strictest setting and require notarization for all installed applications.
Deny standard users the ability to write to application and framework directories through MDM configuration profiles.

bash

# Verify macOS build and Gatekeeper status
sw_vers -productVersion
spctl --status
spctl --master-enable