CVE-2025-24172

A permissions issue was addressed with additional sandbox restrictions

Critical · published March 31, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
60.1
In the wild
Unconfirmed
What it is

🔥 A sneaky permissions oversight opens the door for rogue mail previews, potentially exposing sensitive content! Think of an email inbox like a safe where valuable documents are kept. If the safe has a faulty lock and allows unauthorized people to peek inside, it's like a burglar finding a way to view your secret documents without your permission. An attacker could exploit this oversight to view sensitive information from previews, leading to unauthorized access to confidential data. Imagine the chaos if private emails, personal details, or company secrets were laid bare for the taking — absolutely devastating!

Put simply

Think of an email inbox like a safe where valuable documents are kept. If the safe has a faulty lock and allows unauthorized people to peek inside, it's like a burglar finding a way to view your secret documents without your permission. This permissions issue in macOS allows previews of emails to bypass the intended sandbox restrictions, meaning "Block All Remote Content" protections may not be applied consistently, leaving sensitive information vulnerable.

What to do

An attacker could exploit this oversight to view sensitive information from previews, leading to unauthorized access to confidential data. Imagine the chaos if private emails, personal details, or company secrets were laid bare for the taking — absolutely devastating! Update to macOS Sequoia 15.4, Sonoma 14.7.5, or Ventura 13.7.5 immediately to close this critical gap. Review your email settings to ensure that remote content is adequately blocked across the board. Don't leave your inbox unprotected! You've got this! Follow these steps and secure your mailboxes now! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00925 · 60.1th percentile
Published
2025-03-31T22:22Z
EPSS history
Timeline
  • 31 MAR 22:22Z
    A permissions issue was addressed with additional sandbox restrictions
    cvelistv5