Microsoft Uncovers "Sploitlight" Vulnerability in Apple's macOS, Exposing AI-Cached Data

Microsoft Uncovers Critical Vulnerability in Apple's macOS

Microsoft's Threat Intelligence team has discovered a significant security vulnerability in Apple's macOS operating system, potentially exposing sensitive data cached by Apple Intelligence AI. The vulnerability, dubbed "Sploitlight," exploits Spotlight search plugins to bypass Apple's Transparency, Consent, and Control (TCC) framework 1

1

Source: MacRumors

The Nature of the Vulnerability

The "Sploitlight" exploit, tracked as CVE-2025-31199, allows attackers to circumvent TCC mechanisms designed to restrict access to sensitive user data and system features. By manipulating Spotlight plugins, which are used to index files for macOS search, attackers could potentially access and exfiltrate private information without requiring TCC permissions 2

2

Potential Data Exposure

The vulnerability could have allowed unauthorized access to a wide range of sensitive information cached by Apple Intelligence, including:

1. Precise geolocation data
2. Photo and video metadata
3. Face recognition data from the Photo Library
4. Search history and user preferences
5. AI email summaries

Microsoft researchers noted that the implications of this vulnerability are more severe than previous TCC bypasses due to its ability to extract and leak sensitive information 3

3

Remote Linking and Increased Risk

Source: TechRadar

The vulnerability's impact is further amplified by the remote linking capability between iCloud accounts. An attacker with access to a user's macOS device could potentially exploit the vulnerability to determine remote information of other devices linked to the same iCloud account 2

2

Related Stories

Microsoft patches critical Copilot flaw that let hackers steal 2FA codes with one click

First Zero-Click AI Vulnerability "EchoLeak" Discovered in Microsoft 365 Copilot

Apple Patches Critical Zero-Click Vulnerability, Urges Users to Update Devices

Major Security Flaw Discovered in Popular Web Browsers: Google and Apple Rush to Fix

Apple's Response and Patch

Upon receiving details of the bypass from Microsoft, Apple swiftly addressed the issue in macOS 15.4 and iOS 15.4 updates, released on March 31. The vulnerability was patched before it could be actively exploited 1

1

Apple's security support document for the update stated that the problem was addressed through improved data redaction. Additionally, Apple fixed two other vulnerabilities credited to Microsoft by enhancing symlink validation and improving state management 3

3

Microsoft's Ongoing Security Efforts

Source: Dataconomy

Microsoft has implemented additional security measures in response to this discovery. Defender for Endpoint now detects "suspicious" .mdimporter installations and unusual indexing of sensitive directories 2

2

This incident highlights the ongoing collaboration between tech giants in identifying and addressing critical security vulnerabilities, ultimately enhancing the safety of users' data across platforms.