CVE-2025-24282

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to modify protected parts of the file system.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-242835.5A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.CVE-2025-242848.8This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able CVE-2025-242859.8Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with CVE-2025-242864.9A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.CVE-2025-242876.1A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with ele CVE-2025-242889.8The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and mult CVE-2025-242897.5A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier CVE-2025-242909.9Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor w CVE-2025-242916.1The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling fi CVE-2025-242926.8A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and O CVE-2025-242938.1# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image CVE-2025-242947.5The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompress