macOS Sequoia 15.4 Security Update

What macOS Sequoia 15.4 Fixes

macOS Sequoia 15.4, released March 31, 2025, fixes 165 vulnerabilities in 87 parts of the system, according to Apple's security advisory.

Apple does not say that any of them were exploited before the fix. That makes macOS Sequoia 15.4 a routine security update: worth installing soon, not an emergency.

It has since been superseded: the newest security release for macOS Sequoia is macOS Sequoia 15.8.2, from October 26, 2026, which includes these fixes.

Grouped by us from the impact Apple gives for each fix; the impact lines below are Apple's own.

Which Devices Get macOS Sequoia 15.4

Apple lists macOS Sequoia 15.4 for: macOS Sequoia.

How to Install macOS Sequoia 15.4

On the Mac, open System Settings → General → Software Update. Macs that cannot run the newest macOS are offered the update for their own version there.

Security fixes are cumulative: any later release for the same version includes these as well, so if you are already past macOS Sequoia 15.4 there is nothing to do.

Every Fix in macOS Sequoia 15.4

All 165 CVEs in Apple's advisory, the most serious kinds first. Each entry is the part of the system affected, Apple's description of the impact and the fix, and the CVE ID.

• Audio

  Processing a maliciously crafted file may lead to arbitrary code execution

  The issue was addressed with improved memory handling.

  CVE-2025-24243

• SMB

  An app may be able to execute arbitrary code with kernel privileges

  A buffer overflow issue was addressed with improved memory handling.

  CVE-2025-24228

• AccountPolicy

  A malicious app may be able to gain root privileges

  This issue was addressed by removing the vulnerable code.

  CVE-2025-24234

• AppleMobileFileIntegrity

  An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges

  The issue was addressed with improved checks.

  CVE-2025-31272

• Calendar

  An app may be able to break out of its sandbox

  A path handling issue was addressed with improved validation.

  CVE-2025-30429

• Calendar

  An app may be able to break out of its sandbox

  This issue was addressed with improved checks.

  CVE-2025-24212

• CoreServices

  An app may be able to gain root privileges

  A logic issue was addressed with improved file handling.

  CVE-2025-24170

• Crash Reporter

  An app may be able to gain root privileges

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-24277

• Disk Images

  An app may be able to break out of its sandbox

  A file quarantine bypass was addressed with additional checks.

  CVE-2025-31189

• Disk Images

  An app may be able to break out of its sandbox

  A file access issue was addressed with improved input validation.

  CVE-2025-24255

• DiskArbitration

  A malicious app may be able to gain root privileges

  The issue was addressed with additional permissions checks.

  CVE-2025-30453

• DiskArbitration

  An app may be able to gain root privileges

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-30456

• DiskArbitration

  An app may be able to gain root privileges

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24267 CVE-2025-24258

• dyld

  Apps that appear to use App Sandbox may be able to launch without restrictions

  A library injection issue was addressed with additional restrictions.

  CVE-2025-30462

• GPU Drivers

  An app may be able to cause unexpected system termination or corrupt kernel memory

  An out-of-bounds write issue was addressed with improved bounds checking.

  CVE-2025-30464 CVE-2025-24273

• GPU Drivers

  An app may be able to disclose kernel memory

  The issue was addressed with improved bounds checks.

  CVE-2025-24256

• Installer

  A sandboxed app may be able to access sensitive user data

  A logic issue was addressed with improved checks.

  CVE-2025-24229

• IOGPUFamily

  An app may be able to cause unexpected system termination or write kernel memory

  An out-of-bounds write issue was addressed with improved input validation.

  CVE-2025-24257

• Kernel

  An attacker with user privileges may be able to read kernel memory

  A type confusion issue was addressed with improved memory handling.

  CVE-2025-24196

• Libinfo

  A user may be able to elevate privileges

  An integer overflow was addressed with improved input validation.

  CVE-2025-24195

• libxpc

  An app may be able to break out of its sandbox

  This issue was addressed through improved state management.

  CVE-2025-24178

• libxpc

  An app may be able to gain elevated privileges

  A logic issue was addressed with improved checks.

  CVE-2025-24238

• Notes

  A sandboxed app may be able to access sensitive user data in system logs

  A privacy issue was addressed with improved private data redaction for log entries.

  CVE-2025-24262

• PackageKit

  A malicious app with root privileges may be able to modify the contents of system files

  A permissions issue was addressed with additional restrictions.

  CVE-2025-30446

• Power Services

  An app may be able to break out of its sandbox

  This issue was addressed with additional entitlement checks.

  CVE-2025-24173

• quarantine

  An app may be able to break out of its sandbox

  This issue was addressed with improved checks to prevent unauthorized actions.

  CVE-2025-24284

• SceneKit

  An app may be able to read files outside of its sandbox

  A permissions issue was addressed with additional restrictions.

  CVE-2025-30458

• Shortcuts

  A Shortcut may run with admin privileges without authentication

  An authentication issue was addressed with improved state management.

  CVE-2025-31194

• Siri

  A sandboxed app may be able to access sensitive user data in system logs

  This issue was addressed with improved redaction of sensitive information.

  CVE-2025-30435

• smbx

  An attacker in a privileged position may be able to perform a denial-of-service

  The issue was addressed with improved memory handling.

  CVE-2025-24260

• Software Update

  An app may be able to gain elevated privileges

  The issue was addressed with improved input sanitization.

  CVE-2025-30442

• Software Update

  A user may be able to elevate privileges

  This issue was addressed with improved validation of symlinks.

  CVE-2025-24254

• StorageKit

  An app may be able to gain root privileges

  A permissions issue was addressed with additional restrictions.

  CVE-2025-30449

• System Settings

  An app with root privileges may be able to access private information

  This issue was addressed with improved handling of symlinks.

  CVE-2025-24242

• TCC

  An app may be able to break out of its sandbox

  The issue was addressed by adding additional logic.

  CVE-2025-31195

• Xsan

  An app may be able to cause unexpected system termination or corrupt kernel memory

  A buffer overflow issue was addressed with improved memory handling.

  CVE-2025-24157

• Accessibility

  An app may be able to access sensitive user data

  A logging issue was addressed with improved data redaction.

  CVE-2025-24202

• AirPlay

  An attacker on the local network may be able to leak sensitive user information

  This issue was addressed by removing the vulnerable code.

  CVE-2025-24270

• AirPlay

  An attacker on the local network may be able to bypass authentication policy

  An authentication issue was addressed with improved state management.

  CVE-2025-24206

• App Store

  A malicious app may be able to access private information

  This issue was addressed by removing the vulnerable code.

  CVE-2025-24276

• AppleMobileFileIntegrity

  An app may be able to access protected user data

  A downgrade issue was addressed with additional code-signing restrictions.

  CVE-2025-24239

• AppleMobileFileIntegrity

  A malicious app may be able to read or write to protected files

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24233

• AppleMobileFileIntegrity

  An app may be able to access user-sensitive data

  A privacy issue was addressed by removing the vulnerable code.

  CVE-2025-30443

• Audio

  An app may be able to bypass ASLR

  An out-of-bounds access issue was addressed with improved bounds checking.

  CVE-2025-43205

• Authentication Services

  Password autofill may fill in passwords after failing authentication

  This issue was addressed through improved state management.

  CVE-2025-30430

• Authentication Services

  A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix

  The issue was addressed with improved input validation.

  CVE-2025-24180

• Authentication Services

  A malicious app may be able to access a user's saved passwords

  This issue was addressed by adding a delay between verification code attempts.

  CVE-2025-24245

• Automator

  An app may be able to access protected user data

  A permissions issue was addressed by removing vulnerable code and adding additional checks.

  CVE-2025-30460

• CloudKit

  A malicious app may be able to access private information

  The issue was addressed with improved checks.

  CVE-2025-24215

• CoreMedia

  An app may be able to access sensitive user data

  An access issue was addressed with additional sandbox restrictions.

  CVE-2025-24236

• CoreMedia Playback

  A malicious app may be able to access private information

  A path handling issue was addressed with improved validation.

  CVE-2025-30454

• CoreServices

  An app may be able to access sensitive user data

  This issue was addressed through improved state management.

  CVE-2025-31191

• Dock

  A malicious app may be able to access private information

  The issue was addressed with improved checks.

  CVE-2025-30455

• FaceTime

  An app may be able to access sensitive user data

  This issue was addressed with improved redaction of sensitive information.

  CVE-2025-30451

• FeedbackLogger

  An app may be able to access sensitive user data

  This issue was addressed with improved data protection.

  CVE-2025-24281

• Focus

  An attacker with physical access to a locked device may be able to view sensitive user information

  The issue was addressed with improved checks.

  CVE-2025-30439

• Focus

  An app may be able to access sensitive user data

  A logging issue was addressed with improved data redaction.

  CVE-2025-24283

• Foundation

  An app may be able to access protected user data

  An access issue was addressed with additional sandbox restrictions on the system pasteboards.

  CVE-2025-30461

• Foundation

  An app may be able to access sensitive user data

  The issue was resolved by sanitizing logging

  CVE-2025-30447

• Game Center

  A malicious app may be able to access private information

  The issue was addressed with improved checks.

  CVE-2025-30431

• Handoff

  An app may be able to access sensitive user data

  The issue was addressed with improved restriction of data container access.

  CVE-2025-30463

• iCloud Document Sharing

  An attacker may be able to turn on sharing of an iCloud folder without authentication

  This issue was addressed with additional entitlement checks.

  CVE-2025-30448

• Kernel

  An app may be able to access protected user data

  The issue was addressed with improved checks.

  CVE-2025-24204

• LaunchServices

  A malicious JAR file may bypass Gatekeeper checks

  This issue was addressed with improved handling of executable types.

  CVE-2025-24148

• libnetcore

  An app may be able to read sensitive location information

  A permissions issue was addressed with additional restrictions.

  CVE-2025-31231

• Logging

  An app may be able to access sensitive user data

  A logging issue was addressed with improved data redaction.

  CVE-2025-31199

• macOS Recovery

  An attacker with physical access to a locked device may be able to view sensitive user information

  An authentication issue was addressed with improved state management.

  CVE-2025-31264

• manpages

  An app may be able to access sensitive user data

  This issue was addressed with improved validation of symlinks.

  CVE-2025-30450

• Maps

  An app may be able to read sensitive location information

  A path handling issue was addressed with improved logic.

  CVE-2025-30470

• MediaRemote

  An app may be able to leak sensitive user information

  An authorization issue was addressed with improved state management.

  CVE-2025-46308

• OpenSSH

  An app may be able to access user-sensitive data

  An injection issue was addressed with improved validation.

  CVE-2025-24246

• Python

  A remote attacker may be able to bypass sender policy checks and deliver malicious content via email

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2023-27043

• RemoteViewServices

  An app may be able to access sensitive user data

  A privacy issue was addressed by removing the vulnerable code.

  CVE-2025-30459

• Safari

  A website may be able to bypass Same Origin Policy

  This issue was addressed through improved state management.

  CVE-2025-30466

• Sandbox

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24181

• Security

  A malicious app acting as a HTTPS proxy could get access to sensitive user data

  This issue was addressed with improved access restrictions.

  CVE-2025-24250

• Setup Assistant

  An app may be able to access sensitive user data

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-24268

• Share Sheet

  A malicious app may be able to dismiss the system notification on the Lock Screen that a recording was started

  This issue was addressed with improved access restrictions.

  CVE-2025-30438

• Shortcuts

  A shortcut may be able to bypass sensitive Shortcuts app settings

  This issue was addressed by adding an additional prompt for user consent.

  CVE-2025-43184

• Shortcuts

  An app may be able to access user-sensitive data

  An access issue was addressed with additional sandbox restrictions.

  CVE-2025-24280

• Siri

  An app may be able to access sensitive user data

  The issue was addressed with improved restriction of data container access.

  CVE-2025-31183

• Siri

  An app may be able to access sensitive user data

  This issue was addressed with improved redaction of sensitive information.

  CVE-2025-24217

• Siri

  An app may be able to access sensitive user data

  A privacy issue was addressed by not logging contents of text fields.

  CVE-2025-24214

• Siri

  An app may be able to access user-sensitive data

  An authorization issue was addressed with improved state management.

  CVE-2025-24205

• Siri

  An attacker with physical access may be able to use Siri to access sensitive user data

  This issue was addressed by restricting options offered on a locked device.

  CVE-2025-24198

• StickerKit

  An app may be able to observe unprotected user data

  A privacy issue was addressed by moving sensitive data to a protected location.

  CVE-2025-24263

• StorageKit

  An app may be able to access protected user data

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-31261

• StorageKit

  An app may be able to access protected user data

  This issue was addressed with improved handling of symlinks.

  CVE-2025-24253 CVE-2025-46293 CVE-2025-43278

• StorageKit

  An app may be able to access user-sensitive data

  A race condition was addressed with additional validation.

  CVE-2025-24240

• StorageKit

  An app may be able to bypass Privacy preferences

  A race condition was addressed with additional validation.

  CVE-2025-31188

• Summarization Services

  An app may be able to access information about a user's contacts

  A privacy issue was addressed with improved private data redaction for log entries.

  CVE-2025-24218

• System Settings

  An app may be able to access protected user data

  This issue was addressed with improved validation of symlinks.

  CVE-2025-24278

• Voice Control

  An app may be able to access contacts

  This issue was addressed with improved file handling.

  CVE-2025-24279

• Web Extensions

  Visiting a website may leak sensitive data

  A script imports issue was addressed with improved isolation.

  CVE-2025-24192

• WebKit

  A malicious website may be able to track users in Safari private browsing mode

  This issue was addressed through improved state management.

  CVE-2025-30425

• WindowServer

  An app may be able to trick a user into copying sensitive data to the pasteboard

  A configuration issue was addressed with additional restrictions.

  CVE-2025-24241

• Safari

  Visiting a malicious website may lead to user interface spoofing

  The issue was addressed with improved UI.

  CVE-2025-24113

• Safari

  Visiting a malicious website may lead to address bar spoofing

  The issue was addressed with improved checks.

  CVE-2025-30467

• AirPlay

  An attacker on the local network may be able to cause a denial-of-service

  A null pointer dereference was addressed with improved input validation.

  CVE-2025-31202

• AirPlay

  An attacker on the local network may cause an unexpected app termination

  A type confusion issue was addressed with improved checks.

  CVE-2025-30445

• AirPlay

  An attacker on the local network may be able to corrupt process memory

  A use-after-free issue was addressed with improved memory management.

  CVE-2025-24252

• AirPlay

  An attacker on the local network may cause an unexpected app termination

  The issue was addressed with improved checks.

  CVE-2025-24251 CVE-2025-31197

• BiometricKit

  An app may be able to cause unexpected system termination

  A buffer overflow was addressed with improved bounds checking.

  CVE-2025-24237

• CoreAudio

  Parsing a file may lead to an unexpected app termination

  The issue was addressed with improved checks.

  CVE-2025-24163

• CoreAudio

  Playing a malicious audio file may lead to an unexpected app termination

  An out-of-bounds read issue was addressed with improved input validation.

  CVE-2025-24230

• CoreGraphics

  Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents

  An out-of-bounds read was addressed with improved input validation.

  CVE-2025-31196

• CoreMedia

  Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory

  This issue was addressed with improved memory handling.

  CVE-2025-24211

• CoreMedia

  Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory

  The issue was addressed with improved memory handling.

  CVE-2025-24190

• CoreUtils

  An attacker on the local network may be able to cause a denial-of-service

  An integer overflow was addressed with improved input validation.

  CVE-2025-31203

• Foundation

  An app may be able to cause a denial-of-service

  An uncontrolled format string issue was addressed with improved input validation.

  CVE-2025-24199

• IOMobileFrameBuffer

  An app may be able to corrupt coprocessor memory

  The issue was addressed with improved memory handling.

  CVE-2025-31263

• IOMobileFrameBuffer

  An app may be able to corrupt coprocessor memory

  The issue was addressed with improved bounds checks.

  CVE-2025-30437

• Kerberos Helper

  A remote attacker may be able to cause unexpected app termination or heap corruption

  A memory initialization issue was addressed with improved memory handling.

  CVE-2025-24235

• libxml2

  Parsing a file may lead to an unexpected app termination

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2025-27113 CVE-2024-56171

• Security

  A remote user may be able to cause a denial-of-service

  A validation issue was addressed with improved logic.

  CVE-2025-30471

• SMB

  An app may be able to cause unexpected system termination

  The issue was addressed with improved memory handling.

  CVE-2025-24269

• SMB

  Mounting a maliciously crafted SMB network share may lead to system termination

  A race condition was addressed with improved locking.

  CVE-2025-30444

• SMB

  An app may be able to cause unexpected system termination

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24165

• WebKit

  Processing maliciously crafted web content may lead to an unexpected Safari crash

  The issue was addressed with improved memory handling.

  CVE-2025-24264 CVE-2025-24216

• WebKit

  Processing maliciously crafted web content may lead to an unexpected process crash

  A buffer overflow issue was addressed with improved memory handling.

  CVE-2025-24209

• WebKit

  Processing maliciously crafted web content may lead to an unexpected Safari crash

  A use-after-free issue was addressed with improved memory management.

  CVE-2025-30427

• WindowServer

  An attacker may be able to cause unexpected app termination

  A type confusion issue was addressed with improved checks.

  CVE-2025-24247

• Xsan

  An app may be able to cause unexpected system termination

  A buffer overflow was addressed with improved bounds checking.

  CVE-2025-24266

• Xsan

  An app may be able to cause unexpected system termination

  An out-of-bounds read was addressed with improved bounds checking.

  CVE-2025-24265

• AirDrop

  An app may be able to read arbitrary file metadata

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24097

• AirPlay

  An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without pairing

  An access issue was addressed with improved access restrictions.

  CVE-2025-24271

• AppleMobileFileIntegrity

  An app may be able to modify protected parts of the file system

  The issue was addressed with improved checks.

  CVE-2025-24272

• Audio

  Processing a maliciously crafted font may result in the disclosure of process memory

  The issue was addressed with improved memory handling.

  CVE-2025-24244

• CoreText

  Processing a maliciously crafted font may result in the disclosure of process memory

  An out-of-bounds read issue was addressed with improved input validation.

  CVE-2025-24182

• curl

  An input validation issue was addressed

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2024-9681

• Dock

  An app may be able to modify protected parts of the file system

  This issue was addressed by removing the vulnerable code.

  CVE-2025-31187

• ImageIO

  Parsing an image may lead to disclosure of user information

  A logic error was addressed with improved error handling.

  CVE-2025-24210

• Installer

  An app may be able to check the existence of an arbitrary path on the file system

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-24249

• Kernel

  An app may be able to modify protected parts of the file system

  The issue was addressed with improved checks.

  CVE-2025-24203

• libarchive

  An input validation issue was addressed

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2024-48958

• libnetcore

  Processing maliciously crafted web content may result in the disclosure of process memory

  A logic issue was addressed with improved checks.

  CVE-2025-24194

• libxpc

  An app may be able to delete files for which it does not have permission

  This issue was addressed with improved handling of symlinks.

  CVE-2025-31182

• Mail

  "Block All Remote Content" may not apply for all mail previews

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-24172

• NetworkExtension

  An app may be able to enumerate a user's installed apps

  This issue was addressed with additional entitlement checks.

  CVE-2025-30426

• NSDocument

  A malicious app may be able to access arbitrary files

  This issue was addressed through improved state management.

  CVE-2025-24232

• PackageKit

  An app may be able to modify protected parts of the file system

  The issue was addressed with improved checks.

  CVE-2025-24261

• PackageKit

  An app may be able to modify protected parts of the file system

  A logic issue was addressed with improved checks.

  CVE-2025-24164

• Parental Controls

  An app may be able to retrieve Safari bookmarks without an entitlement check

  This issue was addressed with additional entitlement checks.

  CVE-2025-24259

• Photos Storage

  Deleting a conversation in Messages may expose user contact information in system logging

  A logging issue was addressed with improved data redaction.

  CVE-2025-30424

• RPAC

  An app may be able to modify protected parts of the file system

  The issue was addressed with improved validation of environment variables.

  CVE-2025-24191

• Safari

  A website may be able to access sensor information without user consent

  The issue was addressed with improved checks.

  CVE-2025-31192

• Safari

  A download's origin may be incorrectly associated

  This issue was addressed through improved state management.

  CVE-2025-24167

• Sandbox

  An app may be able to access removable volumes without user consent

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24093

• Sandbox

  An input validation issue was addressed

  The issue was addressed with improved checks.

  CVE-2025-30452

• Shortcuts

  A shortcut may be able to access files that are normally inaccessible to the Shortcuts app

  A permissions issue was addressed with improved validation.

  CVE-2025-30465

• Shortcuts

  A shortcut may be able to access files that are normally inaccessible to the Shortcuts app

  This issue was addressed with improved access restrictions.

  CVE-2025-30433

• Siri

  An app may be able to enumerate devices that have signed into the user's Apple Account

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24248

• Software Update

  An app may be able to modify protected parts of the file system

  A library injection issue was addressed with additional restrictions.

  CVE-2025-24282

• Software Update

  An app may be able to modify protected parts of the file system

  The issue was addressed with improved checks.

  CVE-2025-24231

• Storage Management

  An app may be able to enable iCloud storage features without user consent

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24207

• SystemMigration

  A malicious app may be able to create symlinks to protected regions of the disk

  This issue was addressed with improved validation of symlinks.

  CVE-2025-30457

• Web Extensions

  An app may gain unauthorized access to Local Network

  This issue was addressed with improved permissions checking.

  CVE-2025-31184

• zip

  A path handling issue was addressed with improved validation

  This issue was addressed with improved validation of symlinks.

  CVE-2025-31198

macOS Sequoia Security Release History

macOS Sequoia 15.4 in context: the security releases Apple has published for macOS Sequoia, newest first, with the number of fixes each carried.

The Same Fixes Elsewhere

Apple ships most fixes to every platform that shares the code, and to older versions still under support. These releases close at least one of the same CVEs:

Frequently Asked Questions