CVE-2025-31236: 
macOS vulnerability analysis and mitigation

CVE-2025-31236 is an information disclosure vulnerability discovered in the Finder component of macOS Sequoia. The vulnerability was disclosed and patched on May 12, 2025, as part of the macOS Sequoia 15.5 security update. The issue was discovered by security researchers Kirin@Pwnrin and LFY@secsys from Fudan University (Apple Support, Wiz).

The vulnerability stems from an information disclosure issue in the Finder component of macOS Sequoia that was addressed through improved privacy controls implementation. The vulnerability has received a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local access is required for exploitation. The vulnerability has been classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD, Wiz).

If exploited, this vulnerability could allow a malicious application to gain unauthorized access to sensitive user data through the Finder application (Wiz, Apple Support).

Apple has addressed this vulnerability in macOS Sequoia 15.5. Users are strongly advised to update their systems to this version to receive the security fix that implements improved privacy controls (Apple Support).