ZDI-25-300: Apple macOS PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction with the CoreGraphics framework is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2025-31209.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-300?
The severity of ZDI-25-300 has not been explicitly classified, but it allows remote information disclosure, which is often considered critical.
How do I fix ZDI-25-300?
To fix ZDI-25-300, install the latest updates for Apple macOS that address security vulnerabilities.
Who is affected by ZDI-25-300?
ZDI-25-300 affects installations of Apple macOS that utilize the CoreGraphics framework.
What kind of information can be disclosed due to ZDI-25-300?
ZDI-25-300 can lead to the disclosure of sensitive information on affected macOS installations, but specifics depend on the attack implementation.
Is user interaction required to exploit ZDI-25-300?
Yes, interaction with the CoreGraphics framework is required to exploit the ZDI-25-300 vulnerability.