CVE-2025-31275

MEDIUM
Published Jul 30, 2025 Modified Nov 3, 2025 CWE-274

Description

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to launch any installed app.

Is your site exposed to CVE-2025-31275?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.2
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness Type (CWE)

CWE-274 CWE-274

Affected Products

Vendor Product
apple macos

References

Frequently Asked Questions

What is CVE-2025-31275? +
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to launch any installed app. It has a CVSS v3.1 base score of 6.2 (MEDIUM).
How severe is CVE-2025-31275? +
CVE-2025-31275 has a CVSS v3.1 score of 6.2 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2025-31275? +
CVE-2025-31275 affects products from apple, specifically: macos. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2025-31275? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-62764

Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a …
CVE-2025-54511

Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value …
CVE-2025-20156 9.9

A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to …
CVE-2025-29365 9.8

spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ_STRING_SYSCALL.
CVE-2024-0105 8.9

NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful …
CVE-2024-0106 8.7

NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker may cause an …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2025-31275 — free, no signup required.