Loading vulnerability…
Root Privilege Escalation in Apple DiskArbitration Path Parsing
CVE-2025-30456 is a privilege escalation vulnerability in Apple DiskArbitration affecting iOS, iPadOS, and macOS. The flaw is caused by a parsing issue in the handling of directory paths and was addressed through improved path validation. Available reporting indicates that a malicious application could abuse this path-handling weakness to bypass intended security boundaries and elevate privileges to root. The issue has also been described as enabling application sandbox bypass in affected mobile platforms, indicating that improper validation of directory path input in DiskArbitration can be leveraged to escape normal app confinement and obtain higher privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local malicious application to gain root privileges on the affected device. This can result in full compromise of the local system security model, including bypass of application sandbox restrictions, execution of privileged operations, access to protected data and system resources, and the ability to modify security-sensitive parts of the operating environment.
If you can’t patch tonight, do this now.
No vendor workaround is documented beyond installing the official security updates. Until patching is completed, reduce exposure by limiting installation and execution of untrusted applications, enforcing application control and least-privilege policies, and restricting local code execution paths where feasible.
Patch, then assume compromise.
Apply Apple's security updates that fix the path validation flaw in DiskArbitration. The issue is fixed in iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Systems running earlier affected versions should be upgraded to the appropriate patched release.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.