CVE-2025-24241

A configuration issue was addressed with additional restrictions

Critical · published March 31, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
63.8
In the wild
Unconfirmed
What it is

🚨 A sneaky configuration issue could let an app trick you into copying sensitive data to your clipboard — think of it as a digital pickpocket making a getaway! 🔥 It's like leaving your wallet out on a café table while you look away, only to find someone has swiped your credit card information without you noticing. This vulnerability allows malicious apps to exploit your clipboard like a crafty thief. An attacker could easily capture sensitive information, such as passwords or personal data, without your consent. This could lead to identity theft or unauthorized access to your accounts, making it a critical concern you shouldn't ignore!

Put simply

It's like leaving your wallet out on a café table while you look away, only to find someone has swiped your credit card information without you noticing. This vulnerability allows malicious apps to exploit your clipboard like a crafty thief. This vulnerability arises from insufficient restrictions in managing pasteboard data, allowing rogue applications to access and manipulate what you copy and paste.

What to do

An attacker could easily capture sensitive information, such as passwords or personal data, without your consent. This could lead to identity theft or unauthorized access to your accounts, making it a critical concern you shouldn't ignore! Update your macOS to Sequoia 15.4, Sonoma 14.7.5, or Ventura 13.7.5 immediately to patch this vulnerability. Additionally, be cautious about what apps you grant permissions to, and review clipboard data management practices. You've got this! By following these steps, you'll be one step closer to securing your digital environment! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01043 · 63.8th percentile
Published
2025-03-31T22:22Z
EPSS history
Timeline
  • 31 MAR 22:22Z
    A configuration issue was addressed with additional restrictions
    cvelistv5