Microsoft discloses macOS Spotlight vulnerability exposing Apple Intelligence data
Microsoft researchers discovered a vulnerability in macOS called Sploitlight that could allow attackers to bypass Apple's security framework and access sensitive data cached by Apple Intelligence. Apple reportedly released a fix in March 2025, though unpatched systems remained at risk.
What happened
Microsoft researchers discovered a vulnerability in macOS called CVE-2025-31199, nicknamed 'Sploitlight,' that could allow attackers to bypass the Transparency, Consent and Control (TCC) security framework through the Spotlight search tool.
The vulnerability exploited Spotlight's elevated privileges for indexing files to access protected user data, including files in the Downloads folder and data cached by Apple Intelligence such as precise geolocation, photo and video metadata, facial recognition data, search history, and user preferences.
Reported impact
Malicious applications could deploy specially created plugins in mandatory directories that Spotlight would index and execute without user consent, potentially exposing sensitive information processed and cached by Apple Intelligence.
Index analysis
Apple released a fix for the vulnerability in a macOS update on 31 March 2025, but users who had not updated their systems remained at risk.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.