CVE-2025-30424
📋 TL;DR
A data exposure vulnerability in macOS Messages allows user contact information to leak into system logs when deleting conversations. This affects macOS Ventura, Sequoia, and Sonoma users who delete Messages conversations. Attackers with access to system logs could harvest sensitive contact data.
💻 Affected Systems
- macOS Messages
📦 What is this software?
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
Attackers gain persistent access to system logs and harvest contact information for phishing, social engineering, or identity theft campaigns.
Likely Case
Local attackers or malware with log access collect contact information for targeted attacks against the user's contacts.
If Mitigated
With proper access controls and log monitoring, exposure is limited to authorized administrators only.
🎯 Exploit Status
Exploitation requires access to system logs, which typically requires local access or compromised credentials. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5
Vendor Advisory: https://support.apple.com/en-us/122373
Restart Required: Yes
Instructions:
1. Open System Settings > General > Software Update. 2. Install available updates. 3. Restart when prompted.
🔧 Temporary Workarounds
Avoid deleting Messages conversations
allDo not delete conversations in Messages app until patched
Restrict log access
linuxLimit access to system logs to authorized administrators only
sudo chmod 640 /var/log/*.log
sudo chown root:admin /var/log/*.log
🧯 If You Can't Patch
- Implement strict access controls on system log directories and files
- Monitor system log access and alert on unusual log reading patterns
🔍 How to Verify
Check if Vulnerable:
Check macOS version: if running Ventura <13.7.5, Sequoia <15.4, or Sonoma <14.7.5, system is vulnerableCheck Version:
sw_versVerify Fix Applied:
Verify macOS version is Ventura 13.7.5, Sequoia 15.4, or Sonoma 14.7.5 or later📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to system log files
- Log entries containing contact information from Messages
Network Indicators:
- None - local information disclosure only
SIEM Query:
source="macos_system_logs" AND (event="log_access" OR event="file_read") AND target_file="*/var/log/*" AND user NOT IN ("root", "admin")