CVE-2025-24199: 
macOS vulnerability analysis and mitigation

An uncontrolled format string vulnerability (CVE-2025-24199) was discovered in Apple's macOS Foundation component. The vulnerability affects multiple versions of macOS including Ventura 13.7.5, Sequoia 15.4, and Sonoma 14.7.5, and was disclosed on March 31, 2025. The vulnerability was discovered by Manuel Fernandez of Stackhopper Security (Apple Advisory).

The vulnerability is an uncontrolled format string issue in the Foundation component of macOS. The issue was addressed with improved input validation. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) by CISA-ADP, indicating local access is required but no privileges are needed (NVD).

When exploited, the vulnerability could allow a malicious application to cause a denial-of-service condition on the affected system. This could potentially disrupt system operations and affect service availability (Apple Advisory).

The vulnerability requires local access and user interaction to be exploited. No evidence of active exploitation in the wild has been reported at the time of disclosure (NVD).

Apple has released security updates to address this vulnerability in macOS Ventura 13.7.5, macOS Sequoia 15.4, and macOS Sonoma 14.7.5. Users are advised to update their systems to the latest versions to mitigate the risk (Apple Advisory).