# Sonoma 14.7.5 Sonoma 14.7.5, released March 31, 2025, fixes 109 CVEs in Sonoma. One of them is being exploited (CVE-2025-24085); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/macos/sonoma-14.7.5 - Platform: macOS - Released: Mar 31, 2025 - Priority: Patch now (Closes CVE-2025-24085, exploited (CISA KEV)) - CVEs: 109, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://support.apple.com/en-us/122374 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Sonoma](https://patchblox.com/security/data/product/macos/sonoma.md) | | 14.7.5 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-24085](https://patchblox.com/security/data/cve/CVE-2025-24085.md) | Patch now | CoreMedia: A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2. | 10.0 | 0.1740 | CISA KEV | | [CVE-2025-24190](https://patchblox.com/security/data/cve/CVE-2025-24190.md) | Urgent | CoreMedia: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory | 9.8 | 0.0192 | | | [CVE-2025-24211](https://patchblox.com/security/data/cve/CVE-2025-24211.md) | Urgent | CoreMedia: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory | 9.8 | 0.0192 | | | [CVE-2025-24230](https://patchblox.com/security/data/cve/CVE-2025-24230.md) | Urgent | CoreAudio: Playing a malicious audio file may lead to an unexpected app termination | 9.8 | 0.0192 | | | [CVE-2025-24237](https://patchblox.com/security/data/cve/CVE-2025-24237.md) | Urgent | BiometricKit: An app may be able to cause unexpected system termination | 9.8 | 0.0164 | | | [CVE-2025-24178](https://patchblox.com/security/data/cve/CVE-2025-24178.md) | Urgent | libxpc: An app may be able to break out of its sandbox | 9.8 | 0.0160 | | | [CVE-2025-24126](https://patchblox.com/security/data/cve/CVE-2025-24126.md) | Urgent | AirPlay: An attacker on the local network may be able to corrupt process memory | 9.8 | 0.0136 | | | [CVE-2025-30433](https://patchblox.com/security/data/cve/CVE-2025-30433.md) | Urgent | Shortcuts: A shortcut may be able to access files that are normally inaccessible to the Shortcuts app | 9.8 | 0.0129 | | | [CVE-2025-31182](https://patchblox.com/security/data/cve/CVE-2025-31182.md) | Urgent | libxpc: An app may be able to delete files for which it does not have permission | 9.8 | 0.0126 | | | [CVE-2025-31183](https://patchblox.com/security/data/cve/CVE-2025-31183.md) | Urgent | Siri: An app may be able to access sensitive user data | 9.8 | 0.0124 | | | [CVE-2025-30457](https://patchblox.com/security/data/cve/CVE-2025-30457.md) | Urgent | SystemMigration: A malicious app may be able to create symlinks to protected regions of the disk | 9.8 | 0.0123 | | | [CVE-2025-24256](https://patchblox.com/security/data/cve/CVE-2025-24256.md) | Urgent | GPU Drivers: An app may be able to disclose kernel memory | 9.8 | 0.0123 | | | [CVE-2025-24238](https://patchblox.com/security/data/cve/CVE-2025-24238.md) | Urgent | libxpc: An app may be able to gain elevated privileges | 9.8 | 0.0114 | | | [CVE-2025-24232](https://patchblox.com/security/data/cve/CVE-2025-24232.md) | Urgent | NSDocument: A malicious app may be able to access arbitrary files | 9.8 | 0.0114 | | | [CVE-2025-30452](https://patchblox.com/security/data/cve/CVE-2025-30452.md) | Urgent | Sandbox: An input validation issue was addressed | 9.8 | 0.0114 | | | [CVE-2025-30465](https://patchblox.com/security/data/cve/CVE-2025-30465.md) | Urgent | Shortcuts: A shortcut may be able to access files that are normally inaccessible to the Shortcuts app | 9.8 | 0.0107 | | | [CVE-2025-24266](https://patchblox.com/security/data/cve/CVE-2025-24266.md) | Urgent | Xsan: An app may be able to cause unexpected system termination | 9.8 | 0.0107 | | | [CVE-2025-24181](https://patchblox.com/security/data/cve/CVE-2025-24181.md) | Urgent | Sandbox: An app may be able to access protected user data | 9.8 | 0.0106 | | | [CVE-2025-24207](https://patchblox.com/security/data/cve/CVE-2025-24207.md) | Urgent | Storage Management: An app may be able to enable iCloud storage features without user consent | 9.8 | 0.0106 | | | [CVE-2025-24233](https://patchblox.com/security/data/cve/CVE-2025-24233.md) | Urgent | AppleMobileFileIntegrity: A malicious app may be able to read or write to protected files | 9.8 | 0.0106 | | | [CVE-2025-24241](https://patchblox.com/security/data/cve/CVE-2025-24241.md) | Urgent | WindowServer: An app may be able to trick a user into copying sensitive data to the pasteboard | 9.8 | 0.0106 | | | [CVE-2025-31194](https://patchblox.com/security/data/cve/CVE-2025-31194.md) | Urgent | Shortcuts: A Shortcut may run with admin privileges without authentication | 9.8 | 0.0103 | | | [CVE-2025-30424](https://patchblox.com/security/data/cve/CVE-2025-30424.md) | Urgent | Photos Storage: Deleting a conversation in Messages may expose user contact information in system logging | 9.8 | 0.0102 | | | [CVE-2025-24246](https://patchblox.com/security/data/cve/CVE-2025-24246.md) | Urgent | OpenSSH: An app may be able to access user-sensitive data | 9.8 | 0.0097 | | | [CVE-2025-24247](https://patchblox.com/security/data/cve/CVE-2025-24247.md) | Urgent | WindowServer: An attacker may be able to cause unexpected app termination | 9.8 | 0.0097 | | | [CVE-2025-24250](https://patchblox.com/security/data/cve/CVE-2025-24250.md) | Urgent | Security: A malicious app acting as a HTTPS proxy could get access to sensitive user data | 9.8 | 0.0097 | | | [CVE-2025-24253](https://patchblox.com/security/data/cve/CVE-2025-24253.md) | Urgent | StorageKit: An app may be able to access protected user data | 9.8 | 0.0097 | | | [CVE-2025-24265](https://patchblox.com/security/data/cve/CVE-2025-24265.md) | Urgent | Xsan: An app may be able to cause unexpected system termination | 9.8 | 0.0097 | | | [CVE-2025-24273](https://patchblox.com/security/data/cve/CVE-2025-24273.md) | Urgent | GPU Drivers: An app may be able to cause unexpected system termination or corrupt kernel memory | 9.8 | 0.0097 | | | [CVE-2025-24172](https://patchblox.com/security/data/cve/CVE-2025-24172.md) | Urgent | Mail: "Block All Remote Content" may not apply for all mail previews | 9.8 | 0.0094 | | | [CVE-2025-24195](https://patchblox.com/security/data/cve/CVE-2025-24195.md) | Urgent | Libinfo: A user may be able to elevate privileges | 9.8 | 0.0094 | | | [CVE-2025-24260](https://patchblox.com/security/data/cve/CVE-2025-24260.md) | Urgent | smbx: An attacker in a privileged position may be able to perform a denial-of-service | 9.8 | 0.0090 | | | [CVE-2025-24249](https://patchblox.com/security/data/cve/CVE-2025-24249.md) | Urgent | Installer: An app may be able to check the existence of an arbitrary path on the file system | 9.8 | 0.0090 | | | [CVE-2025-30462](https://patchblox.com/security/data/cve/CVE-2025-30462.md) | Urgent | dyld: Apps that appear to use App Sandbox may be able to launch without restrictions | 9.8 | 0.0089 | | | [CVE-2025-24259](https://patchblox.com/security/data/cve/CVE-2025-24259.md) | Urgent | Parental Controls: An app may be able to retrieve Safari bookmarks without an entitlement check | 9.8 | 0.0079 | | | [CVE-2025-30444](https://patchblox.com/security/data/cve/CVE-2025-30444.md) | Urgent | SMB: Mounting a maliciously crafted SMB network share may lead to system termination | 9.8 | 0.0077 | | | [CVE-2025-30471](https://patchblox.com/security/data/cve/CVE-2025-30471.md) | High | Security: A remote user may be able to cause a denial-of-service | 7.5 | 0.0150 | | | [CVE-2025-24129](https://patchblox.com/security/data/cve/CVE-2025-24129.md) | High | AirPlay: An attacker on the local network may cause an unexpected app termination | 7.5 | 0.0131 | | | [CVE-2025-24252](https://patchblox.com/security/data/cve/CVE-2025-24252.md) | High | AirPlay: An attacker on the local network may be able to corrupt process memory | 8.8 | 0.0131 | | | [CVE-2024-56171](https://patchblox.com/security/data/cve/CVE-2024-56171.md) | High | libxml2: Parsing a file may lead to an unexpected app termination | 9.8 | 0.0118 | | | [CVE-2025-27113](https://patchblox.com/security/data/cve/CVE-2025-27113.md) | High | libxml2: Parsing a file may lead to an unexpected app termination | 7.5 | 0.0105 | | | [CVE-2025-30456](https://patchblox.com/security/data/cve/CVE-2025-30456.md) | High | DiskArbitration: An app may be able to gain root privileges | 7.8 | 0.0100 | | | [CVE-2025-24196](https://patchblox.com/security/data/cve/CVE-2025-24196.md) | High | Kernel: An attacker with user privileges may be able to read kernel memory | 8.8 | 0.0093 | | | [CVE-2025-24177](https://patchblox.com/security/data/cve/CVE-2025-24177.md) | High | AirPlay: An attacker on the local network may be able to cause a denial-of-service | 7.5 | 0.0084 | | | [CVE-2025-24254](https://patchblox.com/security/data/cve/CVE-2025-24254.md) | High | Software Update: A user may be able to elevate privileges | 8.8 | 0.0081 | | | [CVE-2025-24229](https://patchblox.com/security/data/cve/CVE-2025-24229.md) | High | Installer: A sandboxed app may be able to access sensitive user data | 7.4 | 0.0079 | | | [CVE-2025-30460](https://patchblox.com/security/data/cve/CVE-2025-30460.md) | High | Automator: An app may be able to access protected user data | 7.4 | 0.0077 | | | [CVE-2024-54533](https://patchblox.com/security/data/cve/CVE-2024-54533.md) | High | Spotlight: An app may be able to access sensitive user data | 7.0 | 0.0074 | | | [CVE-2025-24243](https://patchblox.com/security/data/cve/CVE-2025-24243.md) | High | Audio: Processing a maliciously crafted file may lead to arbitrary code execution | 7.8 | 0.0052 | | | [CVE-2025-24206](https://patchblox.com/security/data/cve/CVE-2025-24206.md) | High | AirPlay: An attacker on the local network may be able to bypass authentication policy | 7.7 | 0.0036 | | | [CVE-2025-24228](https://patchblox.com/security/data/cve/CVE-2025-24228.md) | High | SMB: An app may be able to execute arbitrary code with kernel privileges | 7.8 | 0.0033 | | | [CVE-2025-24173](https://patchblox.com/security/data/cve/CVE-2025-24173.md) | High | Power Services: An app may be able to break out of its sandbox | 7.8 | 0.0033 | | | [CVE-2025-24255](https://patchblox.com/security/data/cve/CVE-2025-24255.md) | High | Disk Images: An app may be able to break out of its sandbox | 8.4 | 0.0028 | | | [CVE-2025-24234](https://patchblox.com/security/data/cve/CVE-2025-24234.md) | High | AccountPolicy: A malicious app may be able to gain root privileges | 7.8 | 0.0028 | | | [CVE-2025-24277](https://patchblox.com/security/data/cve/CVE-2025-24277.md) | High | Crash Reporter: An app may be able to gain root privileges | 7.8 | 0.0028 | | | [CVE-2025-24170](https://patchblox.com/security/data/cve/CVE-2025-24170.md) | High | CoreServices: An app may be able to gain root privileges | 7.8 | 0.0026 | | | [CVE-2025-30449](https://patchblox.com/security/data/cve/CVE-2025-30449.md) | High | StorageKit: An app may be able to gain root privileges | 7.8 | 0.0025 | | | [CVE-2025-24267](https://patchblox.com/security/data/cve/CVE-2025-24267.md) | High | DiskArbitration: An app may be able to gain root privileges | 7.8 | 0.0023 | | | [CVE-2025-24107](https://patchblox.com/security/data/cve/CVE-2025-24107.md) | High | Kernel: A malicious app may be able to gain root privileges | 7.8 | 0.0022 | | | [CVE-2025-31188](https://patchblox.com/security/data/cve/CVE-2025-31188.md) | High | StorageKit: An app may be able to bypass Privacy preferences | 7.8 | 0.0022 | | | [CVE-2025-31189](https://patchblox.com/security/data/cve/CVE-2025-31189.md) | High | Disk Images: An app may be able to break out of its sandbox | 8.2 | 0.0020 | | | [CVE-2024-9681](https://patchblox.com/security/data/cve/CVE-2024-9681.md) | Routine | curl: An input validation issue was addressed | 6.5 | 0.0199 | | | [CVE-2025-24131](https://patchblox.com/security/data/cve/CVE-2025-24131.md) | Routine | AirPlay: An attacker on the local network may be able to cause a denial-of-service | 6.5 | 0.0127 | | | [CVE-2025-30446](https://patchblox.com/security/data/cve/CVE-2025-30446.md) | Routine | PackageKit: A malicious app with root privileges may be able to modify the contents of system files | 6.5 | 0.0092 | | | [CVE-2025-30432](https://patchblox.com/security/data/cve/CVE-2025-30432.md) | Routine | Kernel: A malicious app may be able to attempt passcode entries on a locked device and thereby cause escalating time delays after 4 failures | 6.4 | 0.0085 | | | [CVE-2025-24157](https://patchblox.com/security/data/cve/CVE-2025-24157.md) | Routine | Xsan: An app may be able to cause unexpected system termination or corrupt kernel memory | 5.6 | 0.0073 | | | [CVE-2025-24272](https://patchblox.com/security/data/cve/CVE-2025-24272.md) | Routine | AppleMobileFileIntegrity: An app may be able to modify protected parts of the file system | 6.8 | 0.0066 | | | [CVE-2024-40864](https://patchblox.com/security/data/cve/CVE-2024-40864.md) | Routine | Apple Account: An attacker in a privileged network position may be able to track a user's activity | 2.7 | 0.0065 | | | [CVE-2025-24203](https://patchblox.com/security/data/cve/CVE-2025-24203.md) | Routine | Kernel: An app may be able to modify protected parts of the file system | 5.0 | 0.0063 | | | [CVE-2025-24279](https://patchblox.com/security/data/cve/CVE-2025-24279.md) | Routine | Voice Control: An app may be able to access contacts | 4.3 | 0.0055 | | | [CVE-2025-24271](https://patchblox.com/security/data/cve/CVE-2025-24271.md) | Routine | AirPlay: An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without pairing | 5.4 | 0.0051 | | | [CVE-2025-24235](https://patchblox.com/security/data/cve/CVE-2025-24235.md) | Routine | Kerberos Helper: A remote attacker may be able to cause unexpected app termination or heap corruption | 5.5 | 0.0050 | | | [CVE-2025-31191](https://patchblox.com/security/data/cve/CVE-2025-31191.md) | Routine | CoreServices: An app may be able to access sensitive user data | 5.5 | 0.0047 | | | [CVE-2025-24198](https://patchblox.com/security/data/cve/CVE-2025-24198.md) | Routine | Siri: An attacker with physical access may be able to use Siri to access sensitive user data | 6.6 | 0.0045 | | | [CVE-2025-24251](https://patchblox.com/security/data/cve/CVE-2025-24251.md) | Routine | AirPlay: An attacker on the local network may cause an unexpected app termination | 6.5 | 0.0039 | | | [CVE-2025-31203](https://patchblox.com/security/data/cve/CVE-2025-31203.md) | Routine | CoreUtils: An attacker on the local network may be able to cause a denial-of-service | 6.5 | 0.0038 | | | [CVE-2025-24097](https://patchblox.com/security/data/cve/CVE-2025-24097.md) | Routine | AirDrop: An app may be able to read arbitrary file metadata | 5.0 | 0.0037 | | | [CVE-2025-30470](https://patchblox.com/security/data/cve/CVE-2025-30470.md) | Routine | Maps: An app may be able to read sensitive location information | 5.5 | 0.0034 | | | [CVE-2025-24210](https://patchblox.com/security/data/cve/CVE-2025-24210.md) | Routine | ImageIO: Parsing an image may lead to disclosure of user information | 5.5 | 0.0033 | | | [CVE-2025-24270](https://patchblox.com/security/data/cve/CVE-2025-24270.md) | Routine | AirPlay: An attacker on the local network may be able to leak sensitive user information | 5.7 | 0.0033 | | | [CVE-2025-24244](https://patchblox.com/security/data/cve/CVE-2025-24244.md) | Routine | Audio: Processing a maliciously crafted font may result in the disclosure of process memory | 5.5 | 0.0032 | | | [CVE-2025-30447](https://patchblox.com/security/data/cve/CVE-2025-30447.md) | Routine | Foundation: An app may be able to access sensitive user data | 5.5 | 0.0032 | | | [CVE-2025-24212](https://patchblox.com/security/data/cve/CVE-2025-24212.md) | Routine | Calendar: An app may be able to break out of its sandbox | 6.3 | 0.0031 | | | [CVE-2025-30429](https://patchblox.com/security/data/cve/CVE-2025-30429.md) | Routine | Calendar: An app may be able to break out of its sandbox | 6.3 | 0.0030 | | | [CVE-2025-30454](https://patchblox.com/security/data/cve/CVE-2025-30454.md) | Routine | CoreMedia Playback: A malicious app may be able to access private information | 5.5 | 0.0030 | | | [CVE-2025-24164](https://patchblox.com/security/data/cve/CVE-2025-24164.md) | Routine | PackageKit: An app may be able to modify protected parts of the file system | 5.5 | 0.0029 | | | [CVE-2025-30438](https://patchblox.com/security/data/cve/CVE-2025-30438.md) | Routine | Share Sheet: A malicious app may be able to dismiss the system notification on the Lock Screen that a recording was started | 5.5 | 0.0029 | | | [CVE-2025-24205](https://patchblox.com/security/data/cve/CVE-2025-24205.md) | Routine | Siri: An app may be able to access user-sensitive data | 5.5 | 0.0029 | | | [CVE-2025-24278](https://patchblox.com/security/data/cve/CVE-2025-24278.md) | Routine | System Settings: An app may be able to access protected user data | 5.5 | 0.0029 | | | [CVE-2025-30443](https://patchblox.com/security/data/cve/CVE-2025-30443.md) | Routine | Found in Apps: An app may be able to access user-sensitive data | 5.5 | 0.0028 | | | [CVE-2025-24236](https://patchblox.com/security/data/cve/CVE-2025-24236.md) | Routine | CoreMedia: An app may be able to access sensitive user data | 5.5 | 0.0028 | | | [CVE-2025-24199](https://patchblox.com/security/data/cve/CVE-2025-24199.md) | Routine | Foundation: An app may be able to cause a denial-of-service | 5.5 | 0.0028 | | | [CVE-2025-30450](https://patchblox.com/security/data/cve/CVE-2025-30450.md) | Routine | manpages: An app may be able to access sensitive user data | 5.5 | 0.0027 | | | [CVE-2025-24215](https://patchblox.com/security/data/cve/CVE-2025-24215.md) | Routine | CloudKit: A malicious app may be able to access private information | 5.5 | 0.0027 | | | [CVE-2025-24280](https://patchblox.com/security/data/cve/CVE-2025-24280.md) | Routine | Shortcuts: An app may be able to access user-sensitive data | 5.5 | 0.0026 | | | [CVE-2025-30455](https://patchblox.com/security/data/cve/CVE-2025-30455.md) | Routine | Dock: A malicious app may be able to access private information | 5.5 | 0.0026 | | | [CVE-2025-31187](https://patchblox.com/security/data/cve/CVE-2025-31187.md) | Routine | Dock: An app may be able to modify protected parts of the file system | 5.5 | 0.0026 | | | [CVE-2025-24261](https://patchblox.com/security/data/cve/CVE-2025-24261.md) | Routine | PackageKit: An app may be able to modify protected parts of the file system | 5.5 | 0.0026 | | | [CVE-2025-24276](https://patchblox.com/security/data/cve/CVE-2025-24276.md) | Routine | App Store: A malicious app may be able to access private information | 5.5 | 0.0025 | | | [CVE-2025-24111](https://patchblox.com/security/data/cve/CVE-2025-24111.md) | Routine | Display: An app may be able to cause unexpected system termination | 5.5 | 0.0025 | | | [CVE-2025-31198](https://patchblox.com/security/data/cve/CVE-2025-31198.md) | Routine | zip: A path handling issue was addressed with improved validation | 5.5 | 0.0023 | | | [CVE-2025-24240](https://patchblox.com/security/data/cve/CVE-2025-24240.md) | Routine | StorageKit: An app may be able to access user-sensitive data | 4.7 | 0.0020 | | | [CVE-2025-43465](https://patchblox.com/security/data/cve/CVE-2025-43465.md) | Routine | ATS: An app may be able to access sensitive user data | 3.3 | 0.0019 | | | [CVE-2025-31261](https://patchblox.com/security/data/cve/CVE-2025-31261.md) | Routine | StorageKit: An app may be able to access protected user data | 5.5 | 0.0019 | | | [CVE-2025-31195](https://patchblox.com/security/data/cve/CVE-2025-31195.md) | Routine | TCC: An app may be able to break out of its sandbox | 6.3 | 0.0018 | | | [CVE-2025-24148](https://patchblox.com/security/data/cve/CVE-2025-24148.md) | Routine | LaunchServices: A malicious JAR file may bypass Gatekeeper checks | 5.5 | 0.0018 | | | [CVE-2025-43205](https://patchblox.com/security/data/cve/CVE-2025-43205.md) | Routine | Audio: An app may be able to bypass ASLR | 4.0 | 0.0016 | | | [CVE-2025-30431](https://patchblox.com/security/data/cve/CVE-2025-30431.md) | Routine | Game Center: A malicious app may be able to access private information | 5.5 | 0.0013 | | | [CVE-2025-24165](https://patchblox.com/security/data/cve/CVE-2025-24165.md) | Routine | SMB: An app may be able to cause unexpected system termination | 5.5 | 0.0012 | | --- Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.