CVE-2025-24109:A downgrade vulnerability in macOS could allow an app to bypass code-signing restrictions and access sensitive user data; the issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, and macOS Sonoma 14.7.3.

splash
Back

Description Preview

Apple addressed a downgrade issue in macOS where an app could bypass code-signing restrictions, potentially enabling access to sensitive user data. The root cause involved an insufficiently restricted downgrade path across components that validate and enforce code signing. The vulnerability could be exploited remotely with no user interaction required. The remediation consists of tightening code-signing restrictions, and the affected releases prior to the patched versions (Ventura before 13.7.3, Sequoia before 15.3, Sonoma before 14.7.3) are now fixed in the respective updates: macOS Ventura 13.7.3, macOS Sequoia 15.3, and macOS Sonoma 14.7.3.

Overview

This section summarizes the vulnerability: A downgrade flaw in macOS allowed an app to sidestep code-signing protections and access sensitive user data, with the issue classified as critical (high impact across confidentiality, integrity, and availability). The vulnerability could be exploited over the network without user interaction and was mitigated by releasing updated macOS versions (Ventura 13.7.3, Sequoia 15.3, Sonoma 14.7.3).

Remediation

  • Upgrade affected systems to the fixed releases:
    • macOS Ventura 13.7.3 or later
    • macOS Sequoia 15.3 or later
    • macOS Sonoma 14.7.3 or later
  • Ensure devices are enrolled in automatic updates and verify that updates have been successfully installed.
  • Enable and enforce Gatekeeper settings to require apps to be signed by Apple or identified developers; periodically verify Gatekeeper status.
  • Audit installed applications and remove or update unsigned or untrusted apps; prefer signed applications from trusted sources.
  • For developers: sign apps with a valid Developer ID and implement strict code-signing checks; consider enabling runtime protections and additional signing validations within your app distribution process.
  • For enterprises: apply MDM policies to block downgrade paths and enforce deployment of the patched OS versions; monitor for any signs of downgraded or unsigned software.
  • After updating, verify the environment by testing code-signing enforcement (e.g., using codesign and spctl tools) and confirming Gatekeeper verification on newly installed apps.

References

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing: Medium
    Manufacturing
  2. Health Care & Social Assistance: Low
    Health Care & Social Assistance
  3. Educational Services: Low
    Educational Services
  4. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  5. Public Administration: Low
    Public Administration
  6. Transportation & Warehousing: Low
    Transportation & Warehousing
  7. Retail Trade: Low
    Retail Trade
  8. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  9. Finance and Insurance: Low
    Finance and Insurance
  10. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  11. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  12. Information: Low
    Information
  13. Accommodation & Food Services: Low
    Accommodation & Food Services
  14. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  15. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  16. Construction: Low
    Construction
  17. Mining: Low
    Mining
  18. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  19. Utilities: Low
    Utilities
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background