Loading vulnerability…
Privilege Escalation in Apple DiskArbitration
CVE-2025-24267 is a privilege escalation vulnerability in Apple DiskArbitration affecting macOS. The flaw is described as a permissions issue that was corrected by adding additional restrictions. Successful exploitation may allow a local application to elevate privileges to root. The issue was fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A successful attacker can escalate from application-level execution to root privileges on the affected macOS system. Root access would permit full administrative control over the host, including modification of system state, access to protected data, installation of persistent components, and execution of further actions with the highest local privileges.
If you can’t patch tonight, do this now.
No specific workaround is available from the provided information. Mitigation is limited to reducing exposure to untrusted local applications and promptly applying Apple's security updates. Standard hardening measures such as restricting installation and execution of untrusted software may reduce exploitation opportunities but do not replace patching.
Patch, then assume compromise.
Upgrade affected systems to a fixed release: macOS Sequoia 15.4, macOS Sonoma 14.7.5, or macOS Ventura 13.7.5, as applicable. Applying Apple's vendor patch is the primary remediation because the vulnerability was addressed through additional restrictions in DiskArbitration.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.