CVE-2025-31258

Published May 12, 2025

Last updated a month ago

Apple

MacOS Sequoia

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-31258 is a vulnerability in macOS Sequoia that allows a malicious application to break out of its sandbox. This is a critical security measure designed to isolate potentially harmful software from affecting the broader system. By escaping the sandbox, an application can gain unauthorized access to sensitive system resources and user data. The vulnerability resides in RemoteViewServices, a core macOS framework responsible for handling content rendering and previews. Apple addressed this issue in macOS Sequoia 15.5 by removing the vulnerable code. A proof-of-concept exploit demonstrating a partial sandbox escape has been released.

Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox.
Source: product-security@apple.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 2.5
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EF1B4AB8-2B51-4EED-BD29-C500C83FAB10",
            "versionEndExcluding": "15.5"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.