CVE-2025-31275

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to launch any installed app.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-274

Affected software

Vendor	Product	Versions
Apple	macOS	< 15.6

References

https://support.apple.com/en-us/124149Release Notes, Vendor Advisory
http://seclists.org/fulldisclosure/2025/Jul/32

Timeline

Published: Jul 30, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-312765.3This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content m CVE-2025-312778.8The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvO CVE-2025-312788.8The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Se CVE-2025-312799.8A permissions issue was addressed with additional restrictions. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.CVE-2025-31289.8A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or CVE-2025-312807.8A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafte CVE-2025-312819.1An input validation issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, CVE-2025-312827.2A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrat CVE-2025-312837.2A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator CVE-2025-312847.2A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to CVE-2025-312857.2A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator CVE-2025-312869.0An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code.