ZDI-CAN-26714: ZDI-25-300: Apple macOS PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Published May 21, 2025

Updated

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction with the CoreGraphics framework is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2025-31209.

Affected Software

1 affected component

macOS

Event History

May 21, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-26714?

The severity of ZDI-CAN-26714 is considered high due to the potential for remote attackers to disclose sensitive information.

How do I fix ZDI-CAN-26714?

To fix ZDI-CAN-26714, you should update your Apple macOS to the latest version where the vulnerability has been patched.

What type of systems are affected by ZDI-CAN-26714?

ZDI-CAN-26714 affects installations of Apple macOS that utilize the CoreGraphics framework.

What does ZDI-CAN-26714 allow an attacker to do?

ZDI-CAN-26714 allows remote attackers to disclose sensitive information on affected systems.

Is user interaction required to exploit ZDI-CAN-26714?

Yes, interaction with the CoreGraphics framework is required to exploit ZDI-CAN-26714.