CVE-2025-24262: Apple macOS Information Disclosure Vulnerability

CVE-2025-24262 Overview

CVE-2025-24262 is an information disclosure vulnerability in Apple macOS that allows a sandboxed application to access sensitive user data recorded in system logs. Apple addressed the flaw by improving private data redaction for log entries. The issue is fixed in macOS Sequoia 15.4.

The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires local access and user interaction, but does not require elevated privileges.

Critical Impact
A sandboxed application can bypass macOS privacy controls and read sensitive user data from system logs that should have been redacted, undermining the isolation guarantees of the App Sandbox.

Affected Products

Apple macOS versions prior to Sequoia 15.4
macOS installations running sandboxed third-party applications
Systems where sensitive user data is written to unified logging (os_log) subsystems

Discovery Timeline

2025-03-31 - CVE-2025-24262 published to NVD
2025-03-31 - Apple releases macOS Sequoia 15.4 with the fix (Apple Support Article)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24262

Vulnerability Analysis

The vulnerability resides in how macOS handles private data redaction within unified system logs. Apple's os_log framework supports marking log fields as private so sensitive values are replaced with <private> when read by unprivileged consumers. Prior to macOS Sequoia 15.4, certain log entries contained user data that was not properly redacted before being persisted to the log store.

A sandboxed application, despite operating under App Sandbox restrictions, retains the ability to read entries from the unified logging system. This access path allowed sandboxed processes to observe sensitive user information that should have been filtered by the logging subsystem. Apple resolved the issue by expanding the set of fields covered by private data redaction.

Root Cause

The root cause is incomplete application of the private-data redaction policy inside macOS log-producing components. Log format strings that emitted user-identifiable data did not consistently mark those fields with the %{private} specifier, or the redaction was not enforced when a sandboxed reader queried the log store. This produced an information exposure pathway [CWE-200] between privileged log producers and unprivileged, sandboxed log consumers.

Attack Vector

Exploitation requires local execution and user interaction, typically achieved by convincing a user to install and run a malicious sandboxed application distributed through unofficial channels or a compromised developer account. Once running, the application queries the unified log store using standard logging APIs and parses returned entries for unredacted sensitive fields. The attack does not require privilege escalation or sandbox escape. Confidentiality is impacted; integrity and availability are not.

See the Apple security advisory and the Full Disclosure announcement for vendor-published technical details.

Detection Methods for CVE-2025-24262

Indicators of Compromise

Sandboxed applications invoking OSLogStore, log show, or log stream APIs outside of legitimate diagnostic workflows
Unexpected processes reading from /var/db/diagnostics/ or /var/db/uuidtext/
Applications with entitlements that include com.apple.security.app-sandbox making sustained queries against the unified logging subsystem

Detection Strategies

Baseline which sandboxed applications legitimately consume system logs, then alert on deviations from that baseline
Correlate log-store access with recently installed or unsigned applications to surface suspicious readers
Inspect Endpoint Security framework events for ES_EVENT_TYPE_NOTIFY_OPEN on log-store paths originating from sandboxed processes

Monitoring Recommendations

Track macOS version inventory and flag endpoints still running versions prior to Sequoia 15.4
Monitor App Store and third-party installers for applications requesting or exercising log-reading APIs
Retain unified log query telemetry in a central data lake to support retrospective hunts for anomalous readers

How to Mitigate CVE-2025-24262

Immediate Actions Required

Upgrade all Mac endpoints to macOS Sequoia 15.4 or later using the vendor-supplied update channel
Audit installed sandboxed applications and remove any that are unsigned, unknown, or sourced outside the Mac App Store and trusted vendors
Rotate credentials, tokens, or other secrets that may have been recorded in system logs on unpatched systems

Patch Information

Apple has released the fix in macOS Sequoia 15.4. Refer to the Apple Support advisory for the complete list of addressed issues and update instructions. There are no partial patches; deploying the full OS update is the supported remediation path.

Workarounds

Restrict installation of sandboxed applications from untrusted sources by enforcing Gatekeeper and notarization policies through mobile device management
Disable or limit verbose logging in applications and services that emit personally identifiable information
Use configuration profiles to prevent non-administrative users from installing third-party applications until the OS update is deployed

bash

# Verify macOS build meets the patched version (Sequoia 15.4 or later)
sw_vers -productVersion

# Trigger the software update workflow to apply the vendor patch
sudo softwareupdate --install --all --restart