macOS Sonoma 14.7.5 Security Update

What macOS Sonoma 14.7.5 Fixes

macOS Sonoma 14.7.5, released March 31, 2025, fixes 115 vulnerabilities in 63 parts of the system, according to Apple's security advisory.

Apple does not say that any of them were exploited before the fix. That makes macOS Sonoma 14.7.5 a routine security update: worth installing soon, not an emergency.

It has since been superseded: the newest security release for macOS Sonoma is macOS Sonoma 14.8.9, from August 6, 2026, which includes these fixes.

Grouped by us from the impact Apple gives for each fix; the impact lines below are Apple's own.

Which Devices Get macOS Sonoma 14.7.5

Apple lists macOS Sonoma 14.7.5 for: macOS Sonoma.

How to Install macOS Sonoma 14.7.5

On the Mac, open System Settings → General → Software Update. Macs that cannot run the newest macOS are offered the update for their own version there.

Security fixes are cumulative: any later release for the same version includes these as well, so if you are already past macOS Sonoma 14.7.5 there is nothing to do.

Every Fix in macOS Sonoma 14.7.5

All 115 CVEs in Apple's advisory, the most serious kinds first. Each entry is the part of the system affected, Apple's description of the impact and the fix, and the CVE ID.

• Audio

  Processing a maliciously crafted file may lead to arbitrary code execution

  The issue was addressed with improved memory handling.

  CVE-2025-24243

• SMB

  An app may be able to execute arbitrary code with kernel privileges

  A buffer overflow issue was addressed with improved memory handling.

  CVE-2025-24228

• AccountPolicy

  A malicious app may be able to gain root privileges

  This issue was addressed by removing the vulnerable code.

  CVE-2025-24234

• Apple Account

  An attacker in a privileged network position may be able to track a user's activity

  The issue was addressed with improved handling of protocols.

  CVE-2024-40864

• Calendar

  An app may be able to break out of its sandbox

  A path handling issue was addressed with improved validation.

  CVE-2025-30429

• Calendar

  An app may be able to break out of its sandbox

  This issue was addressed with improved checks.

  CVE-2025-24212

• CoreMedia

  A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

  A use after free issue was addressed with improved memory management.

  CVE-2025-24085

• CoreServices

  An app may be able to gain root privileges

  A logic issue was addressed with improved file handling.

  CVE-2025-24170

• Crash Reporter

  An app may be able to gain root privileges

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-24277

• Disk Images

  An app may be able to break out of its sandbox

  A file quarantine bypass was addressed with additional checks.

  CVE-2025-31189

• Disk Images

  An app may be able to break out of its sandbox

  A file access issue was addressed with improved input validation.

  CVE-2025-24255

• DiskArbitration

  An app may be able to gain root privileges

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24267

• DiskArbitration

  An app may be able to gain root privileges

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-30456

• dyld

  Apps that appear to use App Sandbox may be able to launch without restrictions

  A library injection issue was addressed with additional restrictions.

  CVE-2025-30462

• GPU Drivers

  An app may be able to disclose kernel memory

  The issue was addressed with improved bounds checks.

  CVE-2025-24256

• GPU Drivers

  An app may be able to cause unexpected system termination or corrupt kernel memory

  An out-of-bounds write issue was addressed with improved bounds checking.

  CVE-2025-24273 CVE-2025-30464

• Installer

  A sandboxed app may be able to access sensitive user data

  A logic issue was addressed with improved checks.

  CVE-2025-24229

• Kernel

  An attacker with user privileges may be able to read kernel memory

  A type confusion issue was addressed with improved memory handling.

  CVE-2025-24196

• Kernel

  A malicious app may be able to gain root privileges

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24107

• Libinfo

  A user may be able to elevate privileges

  An integer overflow was addressed with improved input validation.

  CVE-2025-24195

• libxpc

  An app may be able to break out of its sandbox

  This issue was addressed through improved state management.

  CVE-2025-24178

• libxpc

  An app may be able to gain elevated privileges

  A logic issue was addressed with improved checks.

  CVE-2025-24238

• PackageKit

  A malicious app with root privileges may be able to modify the contents of system files

  A permissions issue was addressed with additional restrictions.

  CVE-2025-30446

• Power Services

  An app may be able to break out of its sandbox

  This issue was addressed with additional entitlement checks.

  CVE-2025-24173

• Shortcuts

  A Shortcut may run with admin privileges without authentication

  An authentication issue was addressed with improved state management.

  CVE-2025-31194

• smbx

  An attacker in a privileged position may be able to perform a denial-of-service

  The issue was addressed with improved memory handling.

  CVE-2025-24260

• Software Update

  A user may be able to elevate privileges

  This issue was addressed with improved validation of symlinks.

  CVE-2025-24254

• StorageKit

  An app may be able to gain root privileges

  A permissions issue was addressed with additional restrictions.

  CVE-2025-30449

• TCC

  An app may be able to break out of its sandbox

  The issue was addressed by adding additional logic.

  CVE-2025-31195

• Xsan

  An app may be able to cause unexpected system termination or corrupt kernel memory

  A buffer overflow issue was addressed with improved memory handling.

  CVE-2025-24157

• AirPlay

  An attacker on the local network may be able to bypass authentication policy

  An authentication issue was addressed with improved state management.

  CVE-2025-24206

• AirPlay

  An attacker on the local network may be able to leak sensitive user information

  This issue was addressed by removing the vulnerable code.

  CVE-2025-24270

• App Store

  A malicious app may be able to access private information

  This issue was addressed by removing the vulnerable code.

  CVE-2025-24276

• AppleMobileFileIntegrity

  A malicious app may be able to read or write to protected files

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24233

• AppleMobileFileIntegrity

  An app may be able to access user-sensitive data

  A privacy issue was addressed by removing the vulnerable code.

  CVE-2025-30443

• ATS

  An app may be able to access sensitive user data

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43465

• Audio

  An app may be able to bypass ASLR

  An out-of-bounds access issue was addressed with improved bounds checking.

  CVE-2025-43205

• Automator

  An app may be able to access protected user data

  A permissions issue was addressed by removing vulnerable code and adding additional checks.

  CVE-2025-30460

• CloudKit

  A malicious app may be able to access private information

  The issue was addressed with improved checks.

  CVE-2025-24215

• CoreMedia

  An app may be able to access sensitive user data

  An access issue was addressed with additional sandbox restrictions.

  CVE-2025-24236

• CoreMedia Playback

  A malicious app may be able to access private information

  A path handling issue was addressed with improved validation.

  CVE-2025-30454

• CoreServices

  An app may be able to access sensitive user data

  This issue was addressed through improved state management.

  CVE-2025-31191

• Dock

  A malicious app may be able to access private information

  The issue was addressed with improved checks.

  CVE-2025-30455

• Foundation

  An app may be able to access sensitive user data

  The issue was resolved by sanitizing logging

  CVE-2025-30447

• Game Center

  A malicious app may be able to access private information

  The issue was addressed with improved checks.

  CVE-2025-30431

• LaunchServices

  A malicious JAR file may bypass Gatekeeper checks

  This issue was addressed with improved handling of executable types.

  CVE-2025-24148

• macOS Recovery

  An attacker with physical access to a locked device may be able to view sensitive user information

  An authentication issue was addressed with improved state management.

  CVE-2025-31264

• manpages

  An app may be able to access sensitive user data

  This issue was addressed with improved validation of symlinks.

  CVE-2025-30450

• Maps

  An app may be able to read sensitive location information

  A path handling issue was addressed with improved logic.

  CVE-2025-30470

• OpenSSH

  An app may be able to access user-sensitive data

  An injection issue was addressed with improved validation.

  CVE-2025-24246

• Sandbox

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24181

• Security

  A malicious app acting as a HTTPS proxy could get access to sensitive user data

  This issue was addressed with improved access restrictions.

  CVE-2025-24250

• Share Sheet

  A malicious app may be able to dismiss the system notification on the Lock Screen that a recording was started

  This issue was addressed with improved access restrictions.

  CVE-2025-30438

• Shortcuts

  An app may be able to access user-sensitive data

  An access issue was addressed with additional sandbox restrictions.

  CVE-2025-24280

• Siri

  An attacker with physical access may be able to use Siri to access sensitive user data

  This issue was addressed by restricting options offered on a locked device.

  CVE-2025-24198

• Siri

  An app may be able to access sensitive user data

  The issue was addressed with improved restriction of data container access.

  CVE-2025-31183

• Siri

  An app may be able to access user-sensitive data

  An authorization issue was addressed with improved state management.

  CVE-2025-24205

• Spotlight

  An app may be able to access sensitive user data

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2024-54533

• StorageKit

  An app may be able to access protected user data

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-31261

• StorageKit

  An app may be able to access protected user data

  This issue was addressed with improved handling of symlinks.

  CVE-2025-24253

• StorageKit

  An app may be able to bypass Privacy preferences

  A race condition was addressed with additional validation.

  CVE-2025-31188

• StorageKit

  An app may be able to access user-sensitive data

  A race condition was addressed with additional validation.

  CVE-2025-24240

• System Settings

  An app may be able to access protected user data

  This issue was addressed with improved validation of symlinks.

  CVE-2025-24278

• Voice Control

  An app may be able to access contacts

  This issue was addressed with improved file handling.

  CVE-2025-24279

• WindowServer

  An app may be able to trick a user into copying sensitive data to the pasteboard

  A configuration issue was addressed with additional restrictions.

  CVE-2025-24241

• AirPlay

  An attacker on the local network may be able to cause a denial-of-service

  A null pointer dereference was addressed with improved input validation.

  CVE-2025-24177 CVE-2025-24179

• AirPlay

  An attacker on the local network may cause an unexpected app termination

  The issue was addressed with improved checks.

  CVE-2025-24251 CVE-2025-31197

• AirPlay

  An attacker on the local network may be able to corrupt process memory

  An input validation issue was addressed.

  CVE-2025-24126

• AirPlay

  An attacker on the local network may be able to cause a denial-of-service

  The issue was addressed with improved memory handling.

  CVE-2025-24131

• AirPlay

  An attacker on the local network may cause an unexpected app termination

  A type confusion issue was addressed with improved checks.

  CVE-2025-24129 CVE-2025-30445

• AirPlay

  An attacker on the local network may be able to corrupt process memory

  A use-after-free issue was addressed with improved memory management.

  CVE-2025-24252

• BiometricKit

  An app may be able to cause unexpected system termination

  A buffer overflow was addressed with improved bounds checking.

  CVE-2025-24237

• CoreAudio

  Playing a malicious audio file may lead to an unexpected app termination

  An out-of-bounds read issue was addressed with improved input validation.

  CVE-2025-24230

• CoreMedia

  Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory

  The issue was addressed with improved memory handling.

  CVE-2025-24190

• CoreMedia

  Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory

  This issue was addressed with improved memory handling.

  CVE-2025-24211

• CoreUtils

  An attacker on the local network may be able to cause a denial-of-service

  An integer overflow was addressed with improved input validation.

  CVE-2025-31203

• Display

  An app may be able to cause unexpected system termination

  A memory corruption issue was addressed with improved state management.

  CVE-2025-24111

• Foundation

  An app may be able to cause a denial-of-service

  An uncontrolled format string issue was addressed with improved input validation.

  CVE-2025-24199

• Kerberos Helper

  A remote attacker may be able to cause unexpected app termination or heap corruption

  A memory initialization issue was addressed with improved memory handling.

  CVE-2025-24235

• libxml2

  Parsing a file may lead to an unexpected app termination

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2025-27113 CVE-2024-56171

• Security

  A remote user may be able to cause a denial-of-service

  A validation issue was addressed with improved logic.

  CVE-2025-30471

• SMB

  Mounting a maliciously crafted SMB network share may lead to system termination

  A race condition was addressed with improved locking.

  CVE-2025-30444

• SMB

  An app may be able to cause unexpected system termination

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24165

• WindowServer

  An attacker may be able to cause unexpected app termination

  A type confusion issue was addressed with improved checks.

  CVE-2025-24247

• Xsan

  An app may be able to cause unexpected system termination

  A buffer overflow was addressed with improved bounds checking.

  CVE-2025-24266

• Xsan

  An app may be able to cause unexpected system termination

  An out-of-bounds read was addressed with improved bounds checking.

  CVE-2025-24265

• AirDrop

  An app may be able to read arbitrary file metadata

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24097

• AirPlay

  An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without pairing

  An access issue was addressed with improved access restrictions.

  CVE-2025-24271

• AppleMobileFileIntegrity

  An app may be able to modify protected parts of the file system

  The issue was addressed with improved checks.

  CVE-2025-24272 CVE-2025-24231

• Audio

  Processing a maliciously crafted font may result in the disclosure of process memory

  The issue was addressed with improved memory handling.

  CVE-2025-24244

• curl

  An input validation issue was addressed

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2024-9681

• Dock

  An app may be able to modify protected parts of the file system

  This issue was addressed by removing the vulnerable code.

  CVE-2025-31187

• ImageIO

  Parsing an image may lead to disclosure of user information

  A logic error was addressed with improved error handling.

  CVE-2025-24210

• Installer

  An app may be able to check the existence of an arbitrary path on the file system

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-24249

• Kernel

  A malicious app may be able to attempt passcode entries on a locked device and thereby cause escalating time delays after 4 failures

  A logic issue was addressed with improved state management.

  CVE-2025-30432

• Kernel

  An app may be able to modify protected parts of the file system

  The issue was addressed with improved checks.

  CVE-2025-24203

• libxpc

  An app may be able to delete files for which it does not have permission

  This issue was addressed with improved handling of symlinks.

  CVE-2025-31182

• Mail

  "Block All Remote Content" may not apply for all mail previews

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-24172

• NSDocument

  A malicious app may be able to access arbitrary files

  This issue was addressed through improved state management.

  CVE-2025-24232

• PackageKit

  An app may be able to modify protected parts of the file system

  The issue was addressed with improved checks.

  CVE-2025-24261

• PackageKit

  An app may be able to modify protected parts of the file system

  A logic issue was addressed with improved checks.

  CVE-2025-24164

• Parental Controls

  An app may be able to retrieve Safari bookmarks without an entitlement check

  This issue was addressed with additional entitlement checks.

  CVE-2025-24259

• Photos Storage

  Deleting a conversation in Messages may expose user contact information in system logging

  A logging issue was addressed with improved data redaction.

  CVE-2025-30424

• Sandbox

  An input validation issue was addressed

  The issue was addressed with improved checks.

  CVE-2025-30452

• Shortcuts

  A shortcut may be able to access files that are normally inaccessible to the Shortcuts app

  A permissions issue was addressed with improved validation.

  CVE-2025-30465

• Shortcuts

  A shortcut may be able to access files that are normally inaccessible to the Shortcuts app

  This issue was addressed with improved access restrictions.

  CVE-2025-30433

• Storage Management

  An app may be able to enable iCloud storage features without user consent

  A permissions issue was addressed with additional restrictions.

  CVE-2025-24207

• SystemMigration

  A malicious app may be able to create symlinks to protected regions of the disk

  This issue was addressed with improved validation of symlinks.

  CVE-2025-30457

• zip

  A path handling issue was addressed with improved validation

  This issue was addressed with improved validation of symlinks.

  CVE-2025-31198

macOS Sonoma Security Release History

macOS Sonoma 14.7.5 in context: the security releases Apple has published for macOS Sonoma, newest first, with the number of fixes each carried.

The Same Fixes Elsewhere

Apple ships most fixes to every platform that shares the code, and to older versions still under support. These releases close at least one of the same CVEs:

Frequently Asked Questions