CVE-2025-31264

MEDIUM

macOS < 13.7.5, < 14.7.5, < 15.4 - Unauthenticated Sensitive User Data Exposure via Physical Access

Title source: llm
STIX 2.1

Description

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker with physical access to a locked device may be able to view sensitive user information.

References (3)

Core 3
Core References
Release Notes, Vendor Advisory
https://support.apple.com/en-us/122373
Release Notes, Vendor Advisory
https://support.apple.com/en-us/122374
Release Notes, Vendor Advisory
https://support.apple.com/en-us/122375

Scores

CVSS v3 4.6
EPSS 0.0019
EPSS Percentile 40.0%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-287
Status published
Products (4)
apple/macos < 13.7.5
Apple/macOS < 13.7.5
Apple/macOS < 14.7.5
Apple/macOS < 15.4
Published May 29, 2025
Tracked Since Feb 18, 2026