-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-12-2025-3 macOS Sequoia 15.5 macOS Sequoia 15.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/122716. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. afpfs Available for: macOS Sequoia Impact: Connecting to a malicious AFP server may corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2025-31246: Joseph Ravichandran (@0xjprx) of MIT CSAIL afpfs Available for: macOS Sequoia Impact: Mounting a maliciously crafted AFP network share may lead to system termination Description: This issue was addressed with improved checks. CVE-2025-31240: Dave G. CVE-2025-31237: Dave G. Apple Intelligence Reports Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with additional restrictions. CVE-2025-31260: Thomas Völkl (@vollkorntomate), SEEMOO, TU Darmstadt AppleJPEG Available for: macOS Sequoia Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved input sanitization. CVE-2025-31251: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative Audio Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: A double free issue was addressed with improved memory management. CVE-2025-31235: Dillon Franke working with Google Project Zero BOM Available for: macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved memory handling. CVE-2025-24222: wac working with Trend Micro Zero Day Initiative Core Bluetooth Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed through improved state management. CVE-2025-31212: Guilherme Rambo of Best Buddy Apps (rambo.codes) CoreAudio Available for: macOS Sequoia Impact: Parsing a file may lead to an unexpected app termination Description: The issue was addressed with improved checks. CVE-2025-31208: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreGraphics Available for: macOS Sequoia Impact: Parsing a file may lead to disclosure of user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2025-31209: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreMedia Available for: macOS Sequoia Impact: Parsing a file may lead to an unexpected app termination Description: A use-after-free issue was addressed with improved memory management. CVE-2025-31239: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreMedia Available for: macOS Sequoia Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved input sanitization. CVE-2025-31233: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative Finder Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: An information disclosure issue was addressed with improved privacy controls. CVE-2025-31236: Kirin@Pwnrin and LFY@secsys from Fudan University Found in Apps Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: A privacy issue was addressed by removing the vulnerable code. CVE-2025-30443: Bohdan Stasiuk (@bohdan_stasiuk) ImageIO Available for: macOS Sequoia Impact: Processing a maliciously crafted image may lead to a denial-of- service Description: A logic issue was addressed with improved checks. CVE-2025-31226: Saagar Jha Installer Available for: macOS Sequoia Impact: A sandboxed app may be able to access sensitive user data Description: A logic issue was addressed with improved checks. CVE-2025-31232: an anonymous researcher Kernel Available for: macOS Sequoia Impact: A remote attacker may cause an unexpected app termination Description: A double free issue was addressed with improved memory management. CVE-2025-31241: Christian Kohlschütter Kernel Available for: macOS Sequoia Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2025-31219: Michael DePlante (@izobashi) and Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative libexpat Available for: macOS Sequoia Impact: Multiple issues in libexpat, including unexpected app termination or arbitrary code execution Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2024-8176 Libinfo Available for: macOS Sequoia Impact: An app may be able to bypass ASLR Description: The issue was addressed with improved checks. CVE-2025-30440: Paweł Płatek (Trail of Bits) mDNSResponder Available for: macOS Sequoia Impact: A user may be able to elevate privileges Description: A correctness issue was addressed with improved checks. CVE-2025-31222: Paweł Płatek (Trail of Bits) Mobile Device Service Available for: macOS Sequoia Impact: A malicious app may be able to gain root privileges Description: An input validation issue was addressed by removing the vulnerable code. CVE-2025-24274: an anonymous researcher NetworkExtension Available for: macOS Sequoia Impact: An app may be able to observe the hostnames of new network connections Description: This issue was addressed by removing the vulnerable code. CVE-2025-31218: Adam M. Notes Available for: macOS Sequoia Impact: Hot corner may unexpectedly reveal a user’s deleted notes Description: The issue was addressed with improved handling of caches. CVE-2025-31256: Sourabhkumar Mishra Notification Center Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2025-24142: LFY@secsys from Fudan University OpenSSH Available for: macOS Sequoia Impact: Multiple issues in OpenSSH Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-26465 CVE-2025-26466 Pro Res Available for: macOS Sequoia Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved input sanitization. CVE-2025-31234: CertiK (@CertiK) Pro Res Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved checks. CVE-2025-31245: wac quarantine Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: A file quarantine bypass was addressed with additional checks. CVE-2025-31244: Csaba Fitzl (@theevilbit) of Kandji RemoteViewServices Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: This issue was addressed by removing the vulnerable code. CVE-2025-31258: an anonymous researcher Sandbox Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A logic issue was addressed with improved checks. CVE-2025-31249: Ryan Dowd (@_rdowd) Sandbox Available for: macOS Sequoia Impact: An app may be able to bypass certain Privacy preferences Description: A logic issue was addressed with improved checks. CVE-2025-31224: Csaba Fitzl (@theevilbit) of Kandji Security Available for: macOS Sequoia Impact: A remote attacker may be able to leak memory Description: An integer overflow was addressed with improved input validation. CVE-2025-31221: Dave G. Security Available for: macOS Sequoia Impact: An app may be able to access associated usernames and websites in a user's iCloud Keychain Description: A logging issue was addressed with improved data redaction. CVE-2025-31213: Kirin (@Pwnrin) and 7feilee SharedFileList Available for: macOS Sequoia Impact: An attacker may gain access to protected parts of the file system Description: A logic issue was addressed with improved state management. CVE-2025-31247: an anonymous researcher SoftwareUpdate Available for: macOS Sequoia Impact: An app may be able to gain elevated privileges Description: The issue was addressed with improved input sanitization. CVE-2025-31259: an anonymous researcher StoreKit Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2025-31242: Eric Dorphy of Twin Cities App Dev LLC TCC Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: An information disclosure issue was addressed with improved privacy controls. CVE-2025-31250: Noah Gregory (wts.dev) Weather Available for: macOS Sequoia Impact: A malicious app may be able to read sensitive location information Description: A privacy issue was addressed by removing sensitive data. CVE-2025-31220: Adam M. WebKit Available for: macOS Sequoia Impact: A type confusion issue could lead to memory corruption Description: This issue was addressed with improved handling of floats. WebKit Bugzilla: 286694 CVE-2025-24213: Google V8 Security Team WebKit Available for: macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved checks. WebKit Bugzilla: 289387 CVE-2025-31223: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs WebKit Bugzilla: 289653 CVE-2025-31238: wac working with Trend Micro Zero Day Initiative WebKit Available for: macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 288814 CVE-2025-31215: Jiming Wang and Jikai Ren WebKit Available for: macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 291506 CVE-2025-31204: Nan Wang(@eternalsakura13) WebKit Bugzilla: 287577 CVE-2025-24223: rheza (@ginggilBesel) and an anonymous researcher WebKit Available for: macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A type confusion issue was addressed with improved state handling. WebKit Bugzilla: 290834 CVE-2025-31206: an anonymous researcher WebKit Available for: macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 289677 CVE-2025-31217: Ignacio Sanmillan (@ulexec) WebKit Available for: macOS Sequoia Impact: A malicious website may exfiltrate data cross-origin Description: The issue was addressed with improved checks. WebKit Bugzilla: 290992 CVE-2025-31205: Ivan Fratric of Google Project Zero WebKit Available for: macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed with improved memory handling. WebKit Bugzilla: 290985 CVE-2025-31257: Juergen Schmied of Lynck GmbH Additional recognition AirDrop We would like to acknowledge Dalibor Milanovic for their assistance. Foundation We would like to acknowledge Claudio Bozzato and Francesco Benvenuto of Cisco Talos for their assistance. Kernel We would like to acknowledge an anonymous researcher for their assistance. Mail We would like to acknowledge IES Red Team of ByteDance for their assistance. MobileGestalt We would like to acknowledge iisBuri for their assistance. NetworkExtension We would like to acknowledge Andrei-Alexandru Bleorțu, Dmytro Merkulov for their assistance. Notes We would like to acknowledge YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab for their assistance. Safari We would like to acknowledge @RenwaX23, Akash Labade, Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India) for their assistance. Sandbox We would like to acknowledge Kirin@Pwnrin and LFY@secsys from Fudan University, Tal Lossos, Zhongquan Li (@Guluisacat) for their assistance. Shortcuts We would like to acknowledge Candace Jensen of Kandji, Chi Yuan Chang of ZUSO ART and taikosoup, Egor Filatov (Positive Technologies), Marcio Almeida from Tanto Security, Monnier Pascaud, Ron Masas of BREAKPOINT.SH for their assistance. WebKit We would like to acknowledge Mike Dougherty and Daniel White of Google Chrome and an anonymous researcher for their assistance. XProtect We would like to acknowledge Csaba Fitzl (@theevilbit) of Kandji for their assistance. macOS Sequoia 15.5 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmgicnAACgkQX+5d1TXa Ivq6fg/+NdJ4Ama9Y9+X60U9RUqXTkmQ+xRkZEbyOXWzu5vjCOWF3qSKynhE1twx wwp0Do9oUjVTKMakk0RPxszKdZjYP5FPW7h5r1iN3pRmZSH9MsOSpB818v0ZL+kL 0LYRwoAlqh5oCjJJ/WlIBaWp1S6urvNcVv+455V7+aJQgalQ8pwn+A45QA7m4h2W zjcbuK5zNVI7BZEohubJ84FBfdgD/24xy8007bVDacMVHyM+1hNV2JED9G0CWVds AWq3JET1qEFcaCHYmbQlhgPHYItEhqbNI/dYuhLM9NSz3+wDbbFbKMuoKEpZMll+ d4AZa4MjX5gE5E9Xl0vPK3I6rTab7RwJQEs0mmuWPEmp9KWUqfm2sqn6JLy+pa6U wZG2b3b3mfIF9FVhpIohQUyfMZp1qkigpFDW7iYqYhvKuEXpoCCFK5CA/zlbSeeO 1T/LUSh5vcDHkamlNvaGuPQrcrgUSexgUIiu/ymnqfg9rHlkcX2x3gwCoomzqZA9 McTCheWhNc/+L6CJutpE2J++aImq6zDLEDF7mHZESPPHvqQ0PdpDTe+Ild61NkN0 3CrOBxmxHJQUXqgOvq5wb7gJ9R7OGFXbnoXDqy7ZptK8JoA1KZvhSk3L1NPnxmP0 4fH8j2do/mGHZnFLxdRu7sSo1St/sMJRK7Rt6WQgFVfW1pnlhbg= =Qqnn -----END PGP SIGNATURE-----