CVE-2025-24247

The bug consists of improper discrimination of data types (type confusion) when processing specific input data. An attacker can remotely, without authentication and without user interaction, send crafted data causing incorrect type interpretation by the system. This results in uncontrolled termination of the running application. Apple eliminated the vulnerability by introducing additional type checks as part of the system update.

An attacker can cause unexpected termination (crash) of an application running on a vulnerable system, leading to denial of service (DoS). According to the CVSS vector, potential violation of data confidentiality and integrity is also possible.

The system should be updated to macOS Sequoia 15.4, macOS Sonoma 14.7.5, or macOS Ventura 13.7.5, in which Apple introduced a fix. Detailed information is available at: https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, https://support.apple.com/en-us/122375.

Apple macOS Sequoia before version 15.4, macOS Sonoma before version 14.7.5, macOS Ventura before version 13.7.5.