---
id: CVE-2025-24268
title: >-
  A parsing issue in the handling of directory paths was addressed with improved
  path validation
summary: >-
  A parsing issue in the handling of directory paths was addressed with improved
  path validation. This issue is fixed in macOS Sequoia 15.4. An app may be able
  to access sensitive user data.
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: apple
product: macos
affected:
  - macos < 15.4
patched:
  - macos 15.4
published: '2026-06-11'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T21:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-24268'
references:
  - url: 'https://support.apple.com/en-us/122373'
    label: product-security@apple.com
tags:
  - nvd
epss: 0.0014
epssPercentile: 0.02821
ingestedAt: '2026-09-30T21:25:07.740Z'
---

## Overview

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data.

## Affected

- `macos < 15.4`

## Remediation

Upgrade past the affected range:

- `macos 15.4`