{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-24172","assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","state":"PUBLISHED","assignerShortName":"apple","dateReserved":"2025-01-17T00:00:44.990Z","datePublished":"2025-03-31T22:22:25.074Z","dateUpdated":"2026-04-02T18:07:45.632Z"},"containers":{"cna":{"problemTypes":[{"descriptions":[{"lang":"en","description":"\"Block All Remote Content\" may not apply for all mail previews"}]}],"affected":[{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"13.7.5","versionType":"custom"},{"version":"0","status":"affected","lessThan":"14.7.5","versionType":"custom"},{"version":"0","status":"affected","lessThan":"15.4","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. \"Block All Remote Content\" may not apply for all mail previews."}],"references":[{"url":"https://support.apple.com/en-us/122373"},{"url":"https://support.apple.com/en-us/122374"},{"url":"https://support.apple.com/en-us/122375"}],"providerMetadata":{"orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","shortName":"apple","dateUpdated":"2026-04-02T18:07:45.632Z"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-276","lang":"en","description":"CWE-276 Incorrect Default Permissions"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-02T13:49:20.412210Z","id":"CVE-2025-24172","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-04-02T13:50:27.580Z"}},{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2025/Apr/10"},{"url":"http://seclists.org/fulldisclosure/2025/Apr/9"},{"url":"http://seclists.org/fulldisclosure/2025/Apr/8"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:06:04.009Z"}}]}}