"A few" security fixes:
https://support.apple.com/en-us/122373

Lots of audio related fixes. Interesting.

Audio
Available for: macOS Sequoia
Impact: Processing a maliciously crafted font may result in the disclosure of process memory
Description: The issue was addressed with improved memory handling.
CVE-2025-24244: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

Audio
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
CVE-2025-24243: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

CoreAudio
Available for: macOS Sequoia
Impact: Parsing a file may lead to an unexpected app termination
Description: The issue was addressed with improved checks.
CVE-2025-24163: Google Threat Analysis Group
CoreAudio

Available for: macOS Sequoia
Impact: Playing a malicious audio file may lead to an unexpected app termination
Description: An out-of-bounds read issue was addressed with improved input validation.
CVE-2025-24230: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

In plain language that means somebody can take over your PC by sending you a hand-crafted audio file. Whether it is required that you play that file isn't stated.

CVE-2025-24243 is not yet available, so no details.

Hello chaps,

I'm still 14.7.4 on my Macbook Air M1 and I'm just wondering if there's any reason to NOT update it to 15.4.0?

My studio deck is on 15.3.2 (because that's what it shipped with) but out abundance of safety (and paranoia) I haven't update the AIR yet.

I've been really happy with Sequoia but does it still run as smoothly on the M1 chips?

Cheers!

R.

Nobody has volunteered to be first penguin for 15.4 yet.

Yea. 14.7.5 just showed in my updates so I might just stick with that and see where the leaves falls with 15.4.

No need for the beeding edge here, mate!

R.

I’ll be updating in the morning. I’m building a pair of new machines. Might as well test 15.4 as much as the previous patch release.

I've been on 15.4 RC for a couple of weeks and it has been great.

Apple should be ashamed of themselves. This CVE record is about the wirst I have seen. Has even less information than the changelog:
https://www.cve.org/CVERecord?id=CVE-2025-24243

Wow, I'm just seeing this now....

No bueno. At all.

I guess it's run, not walk, to update Sonoma to 14.7.5 ....I usually wait a few to see if any problems with the normal suspects, but this one seems to beg off that policy...

Yeah. With what can be figured from the atrocious information available everybody should zeitnah update to one of the macOS versions released on March 31st, even if it's 13.x or 14.x.

Updated to the latest Sequoia yesterday and all is working fine here. Latest Logic 11 and latest Pro Tools are my DAWs.

15.4 might not be as smooth, the dev of
Auburn Sounds posted this over at kvraudio.com

wtf did Apple do?, or what did they leave their pants down on ffs.....? reading that "About the security content of macOS Sonoma 14.7.5 and Sequoia 15.4" briefly this morning looks like pretty much the worst I've read....

I don't use Auburn Sounds plugins myself for anything, but that sounds like it sucks for those that do, and I'm sure they probably aren't the only ones with some issues...

Yeah, i don't use em either,but their Inner Pitch vst is pretty common and also: if that update breaks their VST's, it might break other developers VST's as well. So I'm gonna wait with the update for now (still on Sonoma anyway).

It may be isolated to this developer, who possibly did something in their codebase that was incorrect, inadvised, or deprecated, if this issue is just isolated to their plugins. Without knowing what the issue is, it's premature to speculate. It's possible that this developer doesn't yet know what the issue is, and when they do, may well publish more details if they believe it's a problem caused by Apple that should be addressed by them.

I haven't seen any other widespread reports of plugin issues generally (yet!), so assuming Apple messed up something isn't necessarily correct (much as people do like to jump on that particular bandwagon! ). I've also seen a bunch of people who updated to 15.4 and have experienced no plugin issues at all.

Need more data at this point.

Absolutely mu:zines, more data is needed...

But given the situation I honestly don't remember reading the list of security updates as long as these ones, and as was said over at eclectic light.co etc, as Howard is saying:

"Browse the list of security updates: there’s hardly anything that hasn’t changed. It looks like the largest intermediate update in the history of the Mac."

https://eclecticlight.co/2025/03/31/...14-7-5-13-7-5/

Raised my eyebrows at least...

The Auburn Sounds developer could at least have stated what the symptoms are. For all we know it's another DRM mess.

And he did have those 1-2 months to fix his software if he had participated in the beta. Now he's got to tell his customers to run insecure software (that is known to the world as of yesterday) unless they are still on 13.x or 14.x.

14.x. (not sure about 13.x.) has the same laundry list and impactful update for the most part, so....

more than something wasn't right somewhere one could surmise...

but as is normal with some of these things, obviously some specifics are kept tight, as to not give bad actors a clue and sprinting start to chance trouble.

Yeah, more feedback/data is definetely needed. Aubrun has released an official statement their homepage now:
https://www.auburnsounds.com/faq/Abo...s-plugins.html

No problems here so far. Latest Logic.

What about 3rd party plugin? Any hiccups?

"Why does this happen?

When macOS loads a plugin, this loads the "C runtime", which also loads the "D runtime". This D runtime glue system breaks about every 5 years in macOS.

We are replacing the whole D runtime with a smaller one to fix that issue and restore compatibility, and to avoid similar disruptions in the future. Like often, the responsibility is not one or the other team but lies right at the intersection of subsystems. This is a normal part of using a different and fringe language, this time we weren't smart enough to avoid the issue before users can notice."

So likely limited to this devs plugins only.

Good of them to show accountability! It's a forgivable setback that's not super rare with small devs. What's important is that they're working on it.

I don't think this incident is an alarm for the latest OS updates in general.

None so far with plugins or VIs. Haven't tried them *all* yet but daily use stuff is working fine here. M1 Ultra.

No audio issues, but I have one "not music" external boot drive that recognizes that the 15.4 update is available via SW update, but the download aborts mid way thru with a "failed to personalize the software update" error message. Trying to update the same drive with the full 15.4 installer results in the same message and failure. Tried all the online suggested remedies with no luck, so a reformat, clean install, and Time Machine restore is my next step.

I had the same problem today. Clean install from flash drive also ended with error. The only way to update to 15.4 for me was DFU mode. As it turns out, this is a known issue with 15.4 update.
But I didn't see any reason to upgrade to 15.4. In my case there were only problems.

Someone over at kvraudio posted that out of his 504 (!) plugin (including many old one's) Auburn where the only one crashing. So, they actually might missed some coding stuff which was changed on Apples side during the beta phase of 15.4.

More like not participating in the beta phase.

It seems like they use the D programming language. If you use such an exotic programming language you should really pull up the beta builds of future OSes.

Now Apple Intelligence takes up more than 11 GB on the SSD instead of about 7 GB!

In addition, I was able to update to 15.4 only through DFU (MBP M1 Pro).