CVE-2025-24279

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

This issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access contacts.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-242805.5An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app m CVE-2025-242815.5This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive us CVE-2025-242825.5A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to modif CVE-2025-242835.5A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.CVE-2025-242848.8This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able CVE-2025-242859.8Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with CVE-2025-242864.9A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.CVE-2025-242876.1A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with ele CVE-2025-242889.8The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and mult CVE-2025-242897.5A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier CVE-2025-242909.9Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor w CVE-2025-242916.1The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling fi