In early 2025, a subtle but dangerous vulnerability was discovered in Apple’s macOS—specifically CVE-2025-24146. This bug made it possible for user contact information to appear in system logs when a conversation was deleted in the Messages app. Exploiting this issue could let an attacker with local access recover sensitive data you thought you’d erased.

Let’s break down what happened, what systems were affected, see how redaction failed, and look at what Apple did to fix it.

What Was the Problem?

When you deleted a conversation in Messages, you’d expect that data—especially your contacts—would be wiped clean. But instead, some user contact details (names, numbers, or email addresses) were written in clear text to the macOS system log (/private/var/log/system.log or via the Console app).

This logging wasn’t intentional for end users, but legacy or debugging code didn’t fully redact (blank out) all sensitive fields before writing to log files.

Attackers with local access (or malware running on the system) could inspect your log files and recover this information—even if you’d deleted the conversation. Worst case: if logs are backed up, those details might remain even after updates.

The victim deletes a conversation with a contact called “Jane Doe.”

3. The Messages app logs an event about the conversation deletion, but forgets to redact (remove) “Jane Doe’s” full contact metadata.

`bash

grep "Jane Doe" /private/var/log/system.log

`

2024-02-16 13:22:03.049 Messages[478:30325] Deleted conversation with ID: 0837293; Contact: Jane Doe, +15551231234, jane.doe@example.com

Here’s a simplified example of unsafe logging in Objective-C

// VulnerableCode.m (before Apple’s fix)
NSString *contactInfo = [NSString stringWithFormat:@"%@, %@, %@", 
                        contact.name, contact.phone, contact.email];

NSLog(@"Deleted conversation with ID: %@; Contact: %@", conversationID, contactInfo);

A safer, post-fix version looks like this

// FixedCode.m (after Apple’s fix)
NSLog(@"Deleted conversation with ID: %@", conversationID);
// Contact details are not logged!

Or, using proper redaction

NSString *redactedContact = @"[REDACTED]";
NSLog(@"Deleted conversation with ID: %@; Contact: %@", conversationID, redactedContact);

The Apple patch ensured sensitive fields are either excluded or replaced with redacted text before logging.

Apple addressed CVE-2025-24146 by

- Improving redaction of sensitive information: When a conversation is deleted, Messages no longer logs contact details to system logs.

Reviewing all code paths in the Messages app to ensure sensitive data can’t escape via logs.

Apple’s official advisory:
- Apple Security Updates
- CVE-2025-24146 at cve.org (when published)

Critical version updates:
- macOS Ventura 13.7.3 Release Notes
- macOS Sonoma 14.7.3 Release Notes
- macOS Sequoia 15.3 Release Notes

Time Machine or cloud backups that might capture sensitive logs.

Deleting a conversation should mean it’s really gone—and not just removed from the visible interface.

macOS Sequoia 15.3+

2. Consider manually clearing system logs:

Open Terminal and run

sudo log erase --all

Warning: This wipes all logs and can’t be undone.

3. Be cautious with support or admin accounts on your Mac.

4. Watch Apple Security Updates and apply them regularly.

Conclusion

CVE-2025-24146 is a reminder that privacy isn’t just about encrypting messages or using strong passwords. How software writes logs, and what it records, matters too. Thanks to Apple’s patch, contact information is now safer when you remove conversations in Messages. But always keep your Mac up to date—and watch what you delete.

References

- Apple Security Updates (Official)
- CVE Record by MITRE (when published)
- macOS Release Notes

Timeline

Published on: 01/27/2025 22:15:19 UTC
Last modified on: 03/18/2025 19:15:48 UTC