---
id: CVE-2025-31248
title: >-
  A parsing issue in the handling of directory paths was addressed with improved
  path validation
summary: >-
  A parsing issue in the handling of directory paths was addressed with improved
  path validation. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma
  14.7.3, macOS Ventura 13.7.3. An app may be able to access sensitive user
  data.
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: apple
product: macos
affected:
  - macos < 13.7.3
  - 'macos >= 14.0, < 14.7.3'
  - 'macos >= 15.0, < 15.5'
patched:
  - macos 15.5
published: '2025-11-21'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T10:10:00.227'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-31248'
references:
  - url: 'https://support.apple.com/en-us/122069'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/122070'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/122716'
    label: product-security@apple.com
tags:
  - nvd
epss: 0.00167
epssPercentile: 0.05425
ingestedAt: '2026-10-08T10:28:20.675Z'
---

## Overview

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access sensitive user data.

## Affected

- `macos < 13.7.3`
- `macos >= 14.0, < 14.7.3`
- `macos >= 15.0, < 15.5`

## Remediation

Upgrade past the affected range:

- `macos 15.5`