rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-24072 Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Windows 10 Version 1507
vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:59:15.237Z
CVE-2025-24073 Microsoft DWM Core Library Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Microsoft
product: Windows 10 Version 1507
vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-04-08T17:23:35.320Z
CVE-2025-24074 Microsoft DWM Core Library Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-04-08T17:23:34.689Z
CVE-2025-24075 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Excel 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Office Online Server
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:59:15.872Z
CVE-2025-24076 Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:59:16.458Z
CVE-2025-24077 Microsoft Word Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:58:55.123Z
CVE-2025-24078 Microsoft Word Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Microsoft Word 2016
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:58:55.964Z
CVE-2025-24079 Microsoft Word Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Microsoft Word 2016
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:58:56.654Z
CVE-2025-24080 Microsoft Office Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:58:57.259Z
CVE-2025-24081 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Excel 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Office Online Server
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:58:57.773Z
CVE-2025-24082 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Excel 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Office Online Server
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:58:58.359Z
CVE-2025-24083 Microsoft Office Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-822
description: CWE-822: Untrusted Pointer Dereference
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:58:58.870Z
CVE-2025-24084 Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-822
description: CWE-822: Untrusted Pointer Dereference
Affected products: vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-03-11T16:59:17.033Z
CVE-2025-24085 
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
Problem types: description: A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-01-27T21:45:46.555Z
CVE-2025-24086 
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Processing an image may lead to a denial-of-service.
Problem types: description: Processing an image may lead to a denial-of-service
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-01-27T21:46:23.957Z
CVE-2025-24087 
The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protected user data.
Problem types: description: An app may be able to access protected user data
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:46:07.288Z
CVE-2025-24088 
The issue was addressed by adding additional logic. This issue is fixed in macOS Tahoe 26. An app may be able to override MDM-enforced settings from profiles.
Problem types: description: An app may be able to override MDM-enforced settings from profiles
Affected products: vendor: Apple
product: macOS
Published: 2025-09-15T22:34:56.094Z
CVE-2025-24089 
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps.
Problem types: description: An app may be able to enumerate a user's installed apps
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2026-01-16T17:06:07.361Z
CVE-2025-24090 
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps.
Problem types: description: An app may be able to enumerate a user's installed apps
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2026-01-16T17:06:09.744Z
CVE-2025-24091 
An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.3. An app may be able to cause a denial-of-service.
Problem types: description: An app may be able to cause a denial-of-service
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
Published: 2025-04-30T17:21:08.931Z
CVE-2025-24092 
This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to read sensitive location information.
Problem types: description: An app may be able to read sensitive location information
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:46:00.624Z
CVE-2025-24093 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access removable volumes without user consent.
Problem types: description: An app may be able to access removable volumes without user consent
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:45:48.196Z
CVE-2025-24094 
A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:45:32.661Z
CVE-2025-24095 
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS 2.4. An app may be able to bypass Privacy preferences.
Problem types: description: An app may be able to bypass Privacy preferences
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: visionOS
Published: 2025-03-31T22:22:36.818Z
CVE-2025-24096 
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. A malicious app may be able to access arbitrary files.
Problem types: description: A malicious app may be able to access arbitrary files
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:46:37.289Z
CVE-2025-24097 
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. An app may be able to read arbitrary file metadata.
Problem types: description: An app may be able to read arbitrary file metadata
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2025-03-31T22:24:00.602Z
CVE-2025-24099 
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local attacker may be able to elevate their privileges.
Problem types: description: A local attacker may be able to elevate their privileges
Affected products: vendor: Apple
product: macOS
Published: 2025-01-30T16:32:08.364Z
CVE-2025-24100 
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access information about a user's contacts.
Problem types: description: An app may be able to access information about a user's contacts
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:46:23.128Z
CVE-2025-24101 
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:46:08.935Z
CVE-2025-24102 
The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to determine a user’s current location.
Problem types: description: An app may be able to determine a user’s current location
Affected products: vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
Published: 2025-01-27T21:46:03.076Z
CVE-2025-24103 
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access protected user data.
Problem types: description: An app may be able to access protected user data
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:45:44.885Z
CVE-2025-24104 
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4. Restoring a maliciously crafted backup file may lead to modification of protected system files.
Problem types: description: Restoring a maliciously crafted backup file may lead to modification of protected system files
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
Published: 2025-01-27T21:45:35.220Z
CVE-2025-24106 
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to cause unexpected system termination.
Problem types: description: An app may be able to cause unexpected system termination
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:46:35.615Z
CVE-2025-24107 
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, watchOS 11.3. A malicious app may be able to gain root privileges.
Problem types: description: A malicious app may be able to gain root privileges
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2025-01-27T21:46:31.426Z
CVE-2025-24108 
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protected user data.
Problem types: description: An app may be able to access protected user data
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:45:41.313Z
CVE-2025-24109 
A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:45:25.051Z
CVE-2025-24111 
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.7, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to cause unexpected system termination.
Problem types: description: An app may be able to cause unexpected system termination
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-05-12T21:42:58.814Z
CVE-2025-24112 
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3. Parsing a file may lead to an unexpected app termination.
Problem types: description: Parsing a file may lead to an unexpected app termination
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:45:37.996Z
CVE-2025-24113 
The issue was addressed with improved UI. This issue is fixed in Safari 18.3, Safari 18.4, iOS 18.3 and iPadOS 18.3, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sequoia 15.4, visionOS 2.3, visionOS 2.4, watchOS 11.4. Visiting a malicious website may lead to user interface spoofing.
Problem types: description: Visiting a malicious website may lead to user interface spoofing
Affected products: vendor: Apple
product: Safari
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-01-27T21:45:26.736Z
CVE-2025-24114 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:46:06.457Z
CVE-2025-24115 
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to read files outside of its sandbox.
Problem types: description: An app may be able to read files outside of its sandbox
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:45:43.195Z
CVE-2025-24116 
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to bypass Privacy preferences.
Problem types: description: An app may be able to bypass Privacy preferences
Affected products: vendor: Apple
product: macOS
Published: 2025-01-27T21:46:21.503Z